CVE-2026-111122: SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the malicious comment to be approved and an administrator to subsequently open the Visual Inspector and click the attacker's anchor link, both of which are plausible interactions during routine comment triage.
Affected Software
Event History
Frequently Asked Questions
What conditions must be met for exploitation to succeed?
An unauthenticated attacker must submit a malicious comment containing a crafted anchor href, and the comment must be approved. An administrator must then open the Visual Inspector and click the attacker-controlled anchor link.
Who is most exposed to this issue?
Sites using SiteOrigin CSS versions through 1.6.7 that accept comments and have workflows where administrators review approved comments in the Visual Inspector are exposed. The attack does not require the attacker to have an account or other privileges.
What can be done while patching is not immediately possible?
Prevent approval of untrusted comments, particularly comments containing links or anchor elements, and avoid clicking links from comment content while using the Visual Inspector. Review already approved comments for attacker-controlled anchors before opening them in the inspector.
How can an administrator determine whether malicious content may already be present?
Review approved comments for crafted or suspicious anchor href values, especially in comments that may be opened through the Visual Inspector. The provided information identifies the href parameter in comment anchors as the injection point.