CVE-2026-111122

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-107764

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url commentauthorurl' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-107764 SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url commentauthorurl' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-107764

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 1.6.7 . The root cause is insufficient input sanitization and output escaping of the url (comment_author_url) parameter. Because WordPress core's esc_url() func...

CVE-2026-107764 SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url commentauthorurl' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-102676

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url commentauthorurl' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-107764 SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url commentauthorurl' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-111122

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting in all versions up to and including 1.6.7 . The root cause is insufficient input sanitization and output escaping of the 'href' parameter . An unauthenticated attacker can inject arbitrary web scripts b...

CVE-2026-111122 SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-111122 SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-111122 SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

EUVD-2026-102675

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

PT-2026-115456

Name of the Vulnerable Software and Affected Versions SiteOrigin CSS versions prior to 1.6.8 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the href parameter, enabling the injection...

CVE-2026-111122: Improper Neutralization of Input During Web Page Generation

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

PT-2026-115450

Name of the Vulnerable Software and Affected Versions SiteOrigin CSS versions prior to 1.6.8 Description Stored DOM-Based Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via the comment...

CVE-2026-107764: Improper Neutralization of Input During Web Page Generation

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url commentauthorurl' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

WordPress SiteOrigin CSS plugin <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by poiri3r in WordPress Plugin SiteOrigin CSS versions = 1.6.7...

WordPress SiteOrigin CSS plugin <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Jakub Herman in WordPress Plugin SiteOrigin CSS versions = 1.6.7...

SiteOrigin CSS Cross-Site Scripting Vulnerabilities

SiteOrigin CSS 1.6.7 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input cleaning and output escaping. It involves a DOM-based cross-site scripting attack via the 'url commentauthorurl' parameter. Unauthenticated attackers can inject...

SiteOrigin CSS Cross-Site Scripting Vulnerabilities

SiteOrigin CSS 1.6.7 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'href' parameter, allowing for storage-type DOM-based cross-site scripts. Unverified attackers can inject arbitrary web script...