CVE-2026-66599 describes an unauthenticated Cross Site Scripting (XSS) vulnerability in WPComplete versions up to 2.9.5.6. The flaw allows attackers to inject malicious scripts without authentication, potentially leading to script execution in users' browsers. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network attack vector, low complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to limited confidentiality, integrity, and availability impacts by executing malicious scripts in the context of affected users. This can result in theft of sensitive information, session hijacking, or other malicious actions performed by the attacker via the victim's browser. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider applying temporary mitigations such as disabling or restricting the vulnerable plugin or limiting user input that could trigger the vulnerability.