CVE-2026-16942 in WP Custom HTML Page Plugin
Summary
by MITRE • 08/05/2026
The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in the WP Custom HTML Page WordPress plugin affects versions up to 0.6.2 and represents a critical cross-site scripting flaw that undermines the security model of WordPress installations. This issue stems from inadequate input sanitization within the plugin's custom page handler functionality, which fails to properly validate or escape HTML content before storing it in the database. The vulnerability specifically targets users with the Author role, who typically should not have unrestricted capabilities to inject malicious code into the system.
The technical flaw manifests as a failure to implement proper security controls around HTML sanitization and user privilege validation. When authors create custom pages using this plugin, their input is stored without adequate filtering mechanisms that would normally be applied to content submitted by users with elevated privileges. This oversight allows an attacker with minimal permissions to submit JavaScript code through the custom page handler, which then gets executed in the browser context of any visitor who accesses the affected page.
The operational impact of this vulnerability extends far beyond simple script execution, as it creates a persistent threat vector that can affect all visitors including administrators and privileged users. The stored JavaScript executes in the context of the victim's session, potentially allowing attackers to perform actions such as stealing authentication cookies, redirecting users to malicious sites, or executing additional attacks through the victim's privileges. This represents a classic privilege escalation scenario where a low-privilege user can compromise the entire site through persistent XSS.
Security researchers have identified this vulnerability as aligning with CWE-79 Cross-site Scripting and CWE-20 Improper Input Validation, both of which are fundamental security concerns in web application development. From an ATT&CK perspective, this vulnerability maps to T1566 Initial Access through the exploitation of web application vulnerabilities, potentially leading to T1071 Application Layer Protocol for command and control communications, and T1548 Account Manipulation if attackers can leverage the compromised session to escalate privileges further.
The mitigation strategies for this vulnerability should include immediate plugin updates to versions that properly sanitize HTML input and implement appropriate user privilege controls. Administrators should also consider implementing Content Security Policy headers to limit script execution, conducting thorough security audits of all installed plugins, and ensuring that only trusted users have Author roles or higher. Additionally, regular monitoring of user activities and input validation should be implemented across all custom page handlers and content management features to prevent similar issues from occurring in other components of the WordPress ecosystem.