Quick answers
- Is CVE-2026-115966 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-115966 being exploited in the wild.
- How severe is CVE-2026-115966?
- Medium severity, with a CVSS score of 6.5, published 26 October 2026.
- Which products and versions are affected?
- bPlugins Typing Text – Give your texts many typing effects through 2.2.0.
- Is there a fix for CVE-2026-115966?
- Yes: fixed in 2.2.1. Until then: Update to version 2.2.1 or later. If immediate updating is not possible, restrict plugin access to trusted users and audit contributor-level account permissions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-115966 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-115966?
- Check whether you run bPlugins Typing Text – Give your texts many typing effects at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 2.2.1
Update to version 2.2.1 or later. If immediate updating is not possible, restrict plugin access to trusted users and audit contributor-level account permissions.
Technical details
A stored XSS vulnerability exists in the Typing Text plugin due to improper neutralization of user input during web page generation. The vulnerability affects versions through 2.2.0 and requires contributor-level privileges to exploit. Successfully exploiting this flaw allows an attacker to inject persistent malicious JavaScript that executes in the context of the affected WordPress site for all visitors.
Affected products
- bPlugins Typing Text – Give your texts many typing effects through 2.2.0
Timeline
- 2026-10-17: disclosed: Reported by V1T
- 2026-10-26: advisory: Published by Patchstack