CVE-2026-16942: WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS
The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/wp-custom-html-pagesto a version that resolves this vulnerability.Fixed in 0.6.2 - Configuration
Disable the capability that allows unfiltered HTML (i.e., ensure users without the unfiltered_html capability cannot post unfiltered HTML) so Author-role users cannot store JavaScript that would be served unescaped at public URLs.
WordPress unfiltered_html = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16942?
CVE-2026-16942 has a risk score of 52, indicating a moderate level of severity.
How do I fix CVE-2026-16942?
To fix CVE-2026-16942, update the WP Custom HTML Page plugin to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-16942?
CVE-2026-16942 is a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-16942?
Users with the Author role in WordPress can be affected by CVE-2026-16942 due to improper HTML sanitization.
What could occur if CVE-2026-16942 is exploited?
If exploited, CVE-2026-16942 allows an attacker to execute malicious JavaScript code at a public URL.