CVE-2026-66694 Thrive Themes Coupon CVE debrief

Who should care

Users of Thrive Architect plugin version <= 10.9.3.1, WordPress administrators, Security teams, IT personnel responsible for maintaining WordPress installations, and operators of websites using the affected plugin should be aware of this vulnerability and take immediate action to mitigate the risk. This includes verifying the plugin version, monitoring for suspicious activity, and applying patches or mitigations as needed.

Technical summary

Unauthenticated Cross Site Scripting (XSS) vulnerability in Thrive Architect plugin version <= 10.9.3.1. CVSS Score: 7.1, CVSS Severity: HIGH. The vulnerability allows an attacker to inject malicious JavaScript code into the website, potentially leading to unauthorized actions or data breaches. The plugin's lack of proper input validation and sanitization enables the XSS attack.

Defensive priority

Patch and verify Thrive Architect plugin version, monitor for unusual activity

Recommended defensive actions

• Patch Thrive Architect plugin to version > 10.9.3.1
• Verify plugin version in use
• Monitor for unusual activity

Evidence notes

Evidence from Patchstack and NVD indicates a potential Cross Site Scripting (XSS) vulnerability in Thrive Architect plugin version <= 10.9.3.1. Further verification needed. The vulnerability has been reported and verified by multiple sources, but the full scope of affected systems and potential impact is still being assessed. Defenders should verify the version of Thrive Architect in use, review system logs for suspicious activity, and consider implementing compensating controls until a patch is applied.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.