CVE-2026-107764: SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (commentauthorurl)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's escurl() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it by submitting a crafted, HTML entity-encoded payload through the Website field of a WordPress comment. No authentication or user interaction is required for the attacker to place the payload.
What conditions are required for the malicious script to run?
The crafted comment data must be stored and a user must access a page containing the injected content. The browser then DOM-decodes the entity-encoded payload at an inspector href sink, allowing the injected markup to execute.
Are installations using the affected plugin version exposed by default?
The issue affects SiteOrigin CSS versions through 1.6.7 because comment author URLs are insufficiently sanitized and escaped. Exposure depends on an attacker being able to submit a comment with a Website value and a user later viewing the injected page.
How can I investigate whether exploitation may have occurred?
Review WordPress comments, particularly Website or author URL fields, for unusual HTML entity-encoded values or crafted URL content. Focus on comments associated with pages where SiteOrigin CSS inspector functionality may process comment author URLs.