CVE-2026-107764

HighCVSS 7.2

Published: 16/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Summary

The SiteOrigin CSS plugin for WordPress (versions up to and including 1.6.7) is vulnerable to stored DOM-based Cross-Site Scripting via the 'url (comment_author_url)' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

Risk Assessment

Exploitation is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted payload in the comment 'Website' field to survive storage and execute in the browser.

Recommendation

Update the SiteOrigin CSS plugin to a version later than 1.6.7 or disable it; consider restricting the ability to add comments with URL fields.

Other vulnerabilities in SiteOrigin CSS

CVE-2026-111122High
The SiteOrigin CSS plugin for WordPress (versions up to and including 1.6.7) is vulnerable to stored DOM-based Cross-Site Scripting via the 'href' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

Original NVD description (English source)

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS