medium5.4
CVE-2026-39071
WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field.
Impact
WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role (contributor) can exploit this to redirect user to malicious site or control the account.
Affected products
| Product | Affected versions |
|---|---|
| WordPress Plugin (Spiffy Plugin) | before 5.0.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.