Executive brief
Ultimate Dashboard Pro is a WordPress plugin that provides website administrators with a customizable dashboard interface. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts that can steal visitor data, hijack accounts, or deface pages. The vulnerability can be triggered by an unauthenticated attacker if a user clicks a malicious link or visits a crafted page.
Technical details
This is a DOM-based cross-site scripting (XSS) vulnerability in Ultimate Dashboard Pro versions up to 3.11.2. The flaw results from improper neutralization of user-supplied input during web page generation, allowing attackers to inject arbitrary JavaScript code into the DOM. While the vulnerability is unauthenticated, successful exploitation requires user interaction—specifically, a privileged user (such as an administrator) must click a malicious link or visit a crafted page. An attacker can achieve JavaScript execution in the victim's browser context, enabling session hijacking, credential theft, or malicious actions on behalf of the victim. As of the advisory date, no official patch is available; Patchstack has issued a mitigation rule to block known attack patterns.
Affected products
- MapSteps UG Ultimate Dashboard Pro through 3.11.2
Timeline
- 2026-08-18: disclosed: CVE-2026-66621 published on NVD
- 2026-05-09: other: Reported by dutafi to Patchstack