CVE-2026-16942
Received Received - Intake

Stored XSS in WP Custom HTML Page WordPress Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: WPScan

Description
The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-16942
EUVD
EUVD-2026-53111

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_custom_html_pages wp_custom_html_pages to 0.6.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Custom HTML Page WordPress plugin version 0.6.2 or lower. It allows users with the Author role to inject malicious JavaScript code that is stored and served unescaped at a public URL. The injected script executes for any visitor, including administrators, due to improper HTML input sanitization and lack of permission restrictions.

Detection Guidance

Check if the WP Custom HTML Pages plugin version 0.6.2 or lower is installed. Review custom pages created by users with Author role for injected JavaScript. Inspect network traffic for unescaped scripts served from plugin URLs.

Impact Analysis

An attacker with Author role access could inject malicious scripts that steal sensitive data like cookies or session tokens from administrators or other users. This could lead to account takeovers, unauthorized actions, or defacement of the website. Visitors may also be redirected to phishing pages or have their interactions manipulated.

Compliance Impact

This vulnerability could lead to data breaches, exposing personal or sensitive data, which violates GDPR and HIPAA requirements for data protection and security. Non-compliance may result in legal penalties, fines, or reputational damage for organizations handling regulated data.

Mitigation Strategies

Update the WP Custom HTML Pages plugin to the latest version. Remove or restrict Author role permissions to post unfiltered HTML. Audit existing custom pages for malicious scripts and remove any unauthorized JavaScript.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16942. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart