EUVD-2026-53111
GHSA-34jf-wc5v-9rcm
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Author account required (PR:L), victim must visit page (UI:R), XSS crosses into browser execution context (S:C); no server-side availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators.
AnalysisAI
Stored XSS in the WP Custom HTML Page WordPress plugin (≤0.6.2) enables users with the Author role to persist arbitrary JavaScript via an unsanitized custom page handler, which then executes for every visitor - including administrators - at a publicly accessible URL. The plugin fails both to sanitize HTML input and to enforce WordPress's native unfiltered_html capability restriction, effectively granting Author-level users a privilege they should not have. A publicly available exploit is documented by WPScan; EPSS (0.15%, 5th percentile) indicates no observed widespread opportunistic exploitation, though the public-URL delivery mechanism means admin-targeted attacks require no active phishing.
Technical ContextAI
The WP Custom HTML Page plugin (CPE: cpe:2.3:a:unknown:wp_custom_html_page:*:*:*:*:*:*:*:*) through version 0.6.2 implements a custom page handler that accepts and stores raw HTML without applying WordPress's standard wp_kses sanitization or checking the unfiltered_html capability (CWE-79: Improper Neutralization of Input During Web Page Generation - Stored XSS). WordPress core restricts the ability to post unfiltered HTML to users with the Editor role or above; the Author role explicitly lacks this capability. The plugin bypasses this gatekeeping entirely, allowing Authors to store script tags that are then rendered verbatim in HTTP responses. Because the output URL is public and unauthenticated, the JavaScript payload executes in the browser of any visitor, crossing from the server context into the browser's execution environment - matching the changed-scope indicator (S:C) in the CVSS vector.
RemediationAI
No vendor-released patch with a confirmed fix version has been identified - the CPE vendor field is 'unknown,' suggesting the plugin may be unmaintained or the developer has not yet issued a corrected release. Site administrators should immediately deactivate and uninstall the WP Custom HTML Page plugin until a patched version is confirmed available. As an interim compensating control, revoke the Author role from any untrusted users who do not require it; this eliminates the privilege prerequisite entirely. Administrators should audit all existing custom HTML pages created by Author-level users for embedded script content and remove any suspicious entries from the database. Enabling a Web Application Firewall (WAF) rule targeting stored XSS patterns can detect exploitation attempts but will not prevent storage of malicious content server-side. Monitor the WPScan advisory at https://wpscan.com/vulnerability/cda6b957-2013-4707-a5b5-5ddc04be2f6a/ for patch availability updates.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today