Vulnerability · Published Aug 5, 2026 · Assigned by WPScan
CVE-2026-16942WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS
Medium 5.4
In plain English
A medium-severity cross-site scripting in WP Custom HTML Page from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 86.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Custom HTML Page | 0 – through 0.6.2 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- https://wpscan.com/vulnerability/cda6b957-2013-4707-a5b5-5ddc04be2f6a/ exploit, vdb-entry, technical-description