Stored DOM-Based Cross-Site Scripting in SiteOrigin CSS Plugin for WordPress

CVE-2026-111122

What is CVE-2026-111122?

The SiteOrigin CSS plugin for WordPress contains a vulnerability that allows attackers to initiate stored DOM-based cross-site scripting through the 'href' parameter. This flaw impacts all versions of the plugin up to and including 1.6.7, primarily due to inadequate input sanitization and output escaping. Attackers can inject malicious web scripts into pages that execute when a user accesses the compromised content. Exploitation hinges on the approval of the malicious comment by an administrator, followed by the interaction with crafted links within the Visual Inspector of the plugin. Given the nature of comment management in WordPress, such engagements are commonplace, highlighting the need for immediate attention to mitigate this risk.

References