This vulnerability (CVE-2026-66685) affects Alex Featured Video Plus versions up to and including 2.3.3. It is categorized as CWE-201, indicating insertion of sensitive information into sent data, which can lead to unauthenticated exposure of sensitive data. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official remediation or patch has been documented, and no active exploitation has been observed.

An attacker can remotely access sensitive information without authentication due to the vulnerability. The confidentiality impact is limited, with no integrity or availability impact reported. This exposure could potentially lead to information leakage but does not allow modification or disruption of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor vendor communications for updates. No specific mitigation steps are currently provided by the vendor.