This vulnerability (CVE-2026-66705) is an instance of CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting (XSS). It affects Facebook for WordPress versions up to and including 5.2.1. The flaw allows unauthenticated attackers to inject malicious scripts into web pages generated by the plugin, which can lead to partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and scope changed. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal sensitive information, manipulate site content, or disrupt service availability. The CVSS vector indicates partial impact on confidentiality, integrity, and availability. However, exploitation requires user interaction and no privileges are needed to initiate the attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting this plugin. Monitor vendor channels for updates and apply patches promptly once available.