CVE-2026-16942

None

Open

TLP:CLEAR

WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators.

Details

EPSS Score ⓘ: 0.13%

3.2th percentile
Confidence: 90%
Published: Aug 5, 2026
Last Modified: Aug 5, 2026

Notes

0

Log in to add a note

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

0

Log in to add an opinion

No opinions yet. Be the first to assess this intelligence.