CVE-2026-16942

The WP Custom HTML Page WordPress plugin, in versions up to and including 0.6.2 , is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to sanitize HTML stored through one of its custom page handlers and does not restrict unfiltered HTML submission to autho...