# CVE-2026-66584: 12 Step Meeting List cross-site scripting in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-66584-12-step-meeting-list-cross-site-scripting-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-66584 · Severity: high · CVSS 7.1 · Published 2026-08-24

The 12 Step Meeting List plugin is a widely-used WordPress plugin that manages meeting information for 12-step programs. An unauthenticated attacker can inject malicious JavaScript code into the plugin, which is then executed in visitors' browsers, potentially stealing account credentials, session tokens, or personal data without requiring any special permissions or interaction beyond visiting a malicious page.

## Quick answers

**Is CVE-2026-66584 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66584 being exploited in the wild.

**How severe is CVE-2026-66584?** High severity, with a CVSS score of 7.1, published 24 August 2026.

**Which products and versions are affected?** Code for Recovery 12 Step Meeting List 3.19.16 and earlier.

**Is there a fix for CVE-2026-66584?** A patch was published on 2026-08-20: Version 3.19.17 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66584 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-66584?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the 12 Step Meeting List WordPress plugin affecting versions 3.19.16 and earlier. The plugin fails to properly sanitize and escape user-controlled input, allowing unauthenticated attackers to inject arbitrary JavaScript into the site. The attack requires only network access and can be delivered via a crafted URL or page element; user interaction (such as clicking a link or visiting a page) is required for the payload to execute. Successful exploitation allows an attacker to steal session cookies, perform actions on behalf of logged-in users, or hijack visitor accounts. The vulnerability was patched in version 3.19.17, released on 20 August 2026.

## Affected products

- Code for Recovery 12 Step Meeting List 3.19.16 and earlier

## Timeline

- 2026-08-24: disclosed
- 2026-08-20: patched: Version 3.19.17 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/12-step-meeting-list/vulnerability/wordpress-12-step-meeting-list-plugin-3-19-16-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/12-step-meeting-list/vulnerability/wordpress-12-step-meeting-list-plugin-3-19-16-cross-site-scripting-xss-vulnerability?_s_id=cve)