Liquid Web / Stellarwp Wpcomplete vulnerabilities

2 CVEs affecting Liquid Web / Stellarwp Wpcomplete, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-66479, published 2026-10-08.

More from Liquid Web / Stellarwp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-66599, published 2026-08-24. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.
• CVE-2026-66479, published 2026-10-08. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.