SiteOrigin CSS CVE-2026-107764

Exploitation requires the target WordPress site to accept comments from unauthenticated visitors (open/public comment forms) and to use the SiteOrigin CSS plugin ≤1.6.7. The attacker must place an HTML-entity-encoded payload specifically in the comment 'Website' (comment_author_url) field; the flaw hinges on esc_url() preserving those encoded entities so the value survives storage. Execution is not immediate - it is triggered only when a user accesses a page where the stored comment URL is rendered into the plugin's DOM sink, where the browser decodes the entities into executable markup. Limiting factors: comments must be enabled and reachable unauthenticated, a victim must subsequently load the injected page, and the payload only fires at the specific entity-decoding sink, so sites that disable comments or do not render the affected field are not exposed.

The input CVSS 3.1 score of 7.2 (High) reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) stored XSS with a changed scope (S:C) and limited confidentiality/integrity impact (C:L/I:L/A:N) - the elevated score is driven primarily by the scope change (payload executes in other users' browsers) and lack of authentication, not by severe technical impact. No EPSS probability, CISA KEV listing, or public exploit code is present in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this tempers the real-world urgency considerably versus the raw 7.2. The realistic priority is MODERATE: it is a genuine unauthenticated stored XSS worth patching, but execution depends on a victim rendering an injected page and on the specific DOM-decode sink in the plugin, so it is not drop-everything-critical. A notable nuance: the vulnerability is DOM-based and relies on WordPress core's esc_url() preserving HTML-entity-encoded characters, meaning standard output-escaping assumptions do not block it - defenders relying on esc_url() as a control should verify. Absence of EPSS/KEV/POC is a data gap, not a safety guarantee; treat exploitability as plausible once the patch diff (1.6.7→1.6.8) is public and reversed.

An unauthenticated attacker submits a blog comment on a site running SiteOrigin CSS ≤1.6.7, placing an HTML-entity-encoded script payload in the comment 'Website' (comment_author_url) field; esc_url() preserves the encoded entities so the payload survives storage. When a user later loads a page where that comment URL is rendered into the vulnerable DOM sink, the browser decodes the entities into executable markup and runs the attacker's script in the victim's session. No public exploit code is identified at time of analysis, though the fix commit (1.6.7→1.6.8) is publicly visible and could aid payload reconstruction.