CVE-2025-66073: WordPress WP Webhooks plugin <= 3.3.8

Record summary

CVE-2025-66073 has a selected CVSS score of 7.2 (high).

Description

Deserialization of Untrusted Data vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Object Injection.This issue affects WP Webhooks: from n/a through <= 3.3.8.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 27, 2026 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
WP Webhooks Browse Cozmoslabs / WP Webhooks Default status: unaffected	CVE List	Through 3.3.8	affected

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2025-66073

patchstack.comvdb entry

https://patchstack.com/database/Wordpress/Plugin/wp-webhooks/vulnerability/wordpress-wp-webhooks-plugin-3-3-8-php-object-injection-vulnerability?_s_id=cve

vdp.patchstack.com

https://vdp.patchstack.com/database/Wordpress/Plugin/wp-webhooks/vulnerability/wordpress-wp-webhooks-plugin-3-3-8-php-object-injection-vulnerability?_s_id=cve