{"id":"CVE-2026-107764","kind":"vulnerability","aliases":["CVE-2026-107764"],"related":[],"title":"SiteOrigin CSS plugin: stored XSS via comment author URL","description":"The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.","summary":"The SiteOrigin CSS WordPress plugin up to and including 1.6.7 fails to sanitize the comment author URL field, so a crafted entity-encoded value stored from a comment is decoded into script by the browser. An unauthenticated attacker can run JavaScript in the browser of any user who opens an affected page.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed version of the SiteOrigin CSS plugin in the WordPress admin plugin list or `wp plugin get siteorigin-css --field=version`\n- Flag any version at or below `1.6.7` as exposed","fix":"- Update the SiteOrigin CSS plugin to a version newer than `1.6.7`; the sources do not name the fixed release, so check the plugin changelog\n- Until updated, disable the plugin if it is not essential","status":"open","published_at":"2026-10-16T06:17:06+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:29:49+00:00","updated_at":"2026-10-25T03:29:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:29:49Z","model":"claude-haiku-5-5","output":{"fix":"- Update the SiteOrigin CSS plugin to a version newer than `1.6.7`; the sources do not name the fixed release, so check the plugin changelog\n- Until updated, disable the plugin if it is not essential","reach":"internet","title":"SiteOrigin CSS plugin: stored XSS via comment author URL","impact":"medium","summary":"The SiteOrigin CSS WordPress plugin up to and including 1.6.7 fails to sanitize the comment author URL field, so a crafted entity-encoded value stored from a comment is decoded into script by the browser. An unauthenticated attacker can run JavaScript in the browser of any user who opens an affected page.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs scripts in visitors' browsers, stealing sessions or actions","analyst_note":"Confirm the first patched SiteOrigin CSS version and the exact conditions for the DOM sink at https://nvd.nist.gov/vuln/detail/CVE-2026-107764.","how_to_check":"- Check the installed version of the SiteOrigin CSS plugin in the WordPress admin plugin list or `wp plugin get siteorigin-css --field=version`\n- Flag any version at or below `1.6.7` as exposed","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the SiteOrigin CSS plugin on WordPress with comments open to anonymous visitors, since the flaw is reached through the comment Website field. Sites without this plugin installed, or running a version newer than 1.6.7, are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":3458,"output_tokens":633,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107764':12A,15A '-2026':11A,14A '1.6.7':30B,105C 'access':134C 'affect':72B 'allow':153C 'arbitrari':123C 'attack':59B,120C 'author':8A,36B,95C 'base':86C 'browser':56B,65B,175C 'charact':152C 'comment':7A,35B,49B,94C,162C 'core':143C 'craft':41B,155C 'cross':88C 'cross-sit':87C 'css':2A,23B,76C 'cve':10A,13A 'decod':51B,172C 'dom':85C,171C 'dom-bas':84C 'dom-decod':170C 'due':106C 'encod':44B,151C,158C 'entiti':43B,150C,157C 'entity-encod':42B,149C,156C 'esc':145C 'escap':113C 'execut':130C,177C 'fail':31B 'field':38B,164C 'host':19B 'html':148C 'includ':29B,104C 'inject':122C,136C 'input':109C 'insuffici':108C 'javascript':62B 'make':115C 'markup':178C 'open':70B 'output':112C 'packag':16B 'page':73B,127C,137C 'paramet':97C 'payload':159C 'plugin':3A,25B,77C 'possibl':117C,140C 'preserv':147C 'run':61B 'sanit':33B,110C 'script':53B,90C,125C 'self':18B 'self-host':17B 'sink':181C 'site':89C 'siteorigin':1A,22B,75C 'storag':167C 'store':4A,46B,83C 'surviv':166C 'unauthent':58B,119C 'url':9A,37B,93C,96C,146C 'user':68B,133C 'valu':45B 'version':100C 'via':6A,91C 'vulner':81C 'web':124C 'websit':163C 'whenev':131C 'wordpress':20B,24B,79C,142C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Sites running the SiteOrigin CSS plugin on WordPress with comments open to anonymous visitors, since the flaw is reached through the comment Website field. Sites without this plugin installed, or running a version newer than 1.6.7, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T06:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107764","severity":null,"published_at":"2026-10-16T06:17:06+00:00","modified_at":"2026-10-16T15:17:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}