This vulnerability (CVE-2026-66685) affects Alex Featured Video Plus versions up to 2.3.3 and is characterized as an unauthenticated sensitive data exposure issue. It is categorized under CWE-201, which involves insertion of sensitive information into sent data. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official remediation or patch has been published yet, and no known exploits have been reported.

An unauthenticated attacker can gain access to sensitive information due to improper handling of data in the affected versions of Featured Video Plus. The confidentiality impact is limited, and there is no impact on integrity or availability. This exposure could potentially lead to information disclosure risks depending on the nature of the sensitive data involved.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected component or implementing compensating controls to protect sensitive data. Monitor vendor communications for updates on patches or official mitigations.