Stored DOM-Based Cross-Site Scripting Vulnerability in SiteOrigin CSS Plugin for WordPress
CVE-2026-107764

7.2HIGH

Key Information:

Vendor

WordPress
Status
Siteorigin Css
Vendor
CVE Published:
16 October 2026

What is CVE-2026-107764?

The SiteOrigin CSS plugin for WordPress has a vulnerability that allows for Stored DOM-Based Cross-Site Scripting through the 'url (comment_author_url)' parameter. This flaw exists in versions up to 1.6.7 due to inadequate input sanitization and output escaping. When an attacker exploits this vulnerability, they can inject arbitrary web scripts into the user interface. As a result, these scripts will execute automatically whenever a user accesses the page containing the malicious code. This occurs because the core functionality of WordPress preserves HTML entity-encoded characters, allowing crafted payloads to remain stored and be rendered as executable code in the browser.

Affected Version(s)

SiteOrigin CSS 0 <= 1.6.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/so-css/tags/1....
https://plugins.trac.wordpress.org/browser/so-css/tags/1....

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jakub Herman
.