CVE-2026-16942

CVE-2026-16942 affects the WP Custom HTML Pages plugin for WordPress up to version 0.6.2. The root cause is that HTML stored via a custom page handler is not properly sanitized, and access controls do not restrict who can post unfiltered HTML, enabling users with the Author role to store JavaScri...