This vulnerability (CVE-2026-66440) affects WPIDE – File Manager & Code Editor by XplodedThemes in versions <= 3.5.7. It is classified as CWE-79, indicating improper neutralization of input during web page generation, resulting in Cross-Site Scripting (XSS). The flaw allows unauthenticated attackers to inject malicious scripts, potentially impacting confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and scope change with low impact on confidentiality, integrity, and availability. As of the data provided, no official fix or patch is documented, and no known exploits have been observed.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected application, potentially allowing attackers to steal sensitive information, manipulate data, or disrupt service. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. Since the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying web application firewalls or input validation controls to mitigate potential exploitation. Monitor vendor channels for updates and patches addressing this vulnerability.