CVE-2026-16942CWE-79cross-site-scripting

CVE-2026-16942

Medium · published August 5, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
12.6
In the wild
Unconfirmed
What it is

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00226 · 12.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-05T11:16Z
References (1)
https://wpscan.com/vulnerability/cda6b957-2013-4707-a5b5-5ddc04be2f6a/ · [email protected]
EPSS history
Timeline
  • 05 AUG 06:00Z
    WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS
    cvelistv5