Live › vulnerability › CVE-2026-107764
Go to dashboardThe SiteOrigin CSS WordPress plugin up to and including 1.6.7 fails to sanitize the comment author URL field, so a crafted entity-encoded value stored from a comment is decoded into script by the browser. An unauthenticated attacker can run JavaScript in the browser of any user who opens an affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the SiteOrigin CSS plugin on WordPress with comments open to anonymous visitors, since the flaw is reached through the comment Website field. Sites without this plugin installed, or running a version newer than 1.6.7, are not affected.
No product ranges from the sources yet.
wp plugin get siteorigin-css --field=version1.6.7 as exposed1.6.7; the sources do not name the fixed release, so check the plugin changelogEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.
This page as .md · .json · in your agent: get_signal("CVE-2026-107764")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.