---
id: "CVE-2026-107764"
kind: "vulnerability"
aliases: ["CVE-2026-107764"]
title: "SiteOrigin CSS plugin: stored XSS via comment author URL"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress"]
not_affected_if: ["patched-version", "plugin-not-installed"]
published_at: "2026-10-16T06:17:06+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:29:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107764", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# SiteOrigin CSS plugin: stored XSS via comment author URL

The SiteOrigin CSS WordPress plugin up to and including 1.6.7 fails to sanitize the comment author URL field, so a crafted entity-encoded value stored from a comment is decoded into script by the browser. An unauthenticated attacker can run JavaScript in the browser of any user who opens an affected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the SiteOrigin CSS plugin in the WordPress admin plugin list or `wp plugin get siteorigin-css --field=version`
- Flag any version at or below `1.6.7` as exposed

## Fix

- Update the SiteOrigin CSS plugin to a version newer than `1.6.7`; the sources do not name the fixed release, so check the plugin changelog
- Until updated, disable the plugin if it is not essential

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107764

## From the sources

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_