CVE-2026-111122
HighCVSS 7.2Summary
The SiteOrigin CSS plugin for WordPress (versions up to and including 1.6.7) is vulnerable to stored DOM-based Cross-Site Scripting via the 'href' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.
Risk Assessment
Exploitation requires approval of a malicious comment and an administrator subsequently clicking the attacker's anchor link in the Visual Inspector, potentially leading to code execution in the administrator's session context.
Recommendation
Update the SiteOrigin CSS plugin to a version later than 1.6.7 or disable it; exercise caution when approving comments and clicking links in the Visual Inspector.
Other vulnerabilities in SiteOrigin CSS
Original NVD description (English source)
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the malicious comment to be approved and an administrator to subsequently open the Visual Inspector and click the attacker's anchor link, both of which are plausible interactions during routine comment triage.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS