CVE-2026-16942mediumCWE-79

CVE-2026-16942: medium-severity vulnerability in WP Custom HTML Page

WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS

Published

Follow this CVE+ Monitor WP Custom HTML Page

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.4epss 0.2%
The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Unknown · WP Custom HTML Page
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.