WP Custom HTML Page author content permits stored XSS
WP Custom HTML Page through 0.6.2 lets an Author store unsanitized HTML through a custom-page handler without requiring unfiltered_html. The plugin later serves that value unescaped at a public URL, so embedded JavaScript executes in the WordPress site origin for visitors, including administrators. This unscored record received deeper review because Author-level stored XSS can reach an administrator. The CNA does not disclose the handler, field name or public route.
- Component
- WP Custom HTML Page
- Plugin slug
wp-custom-html-page- Affected
- <= 0.6.2
- Safe version
> 0.6.2- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update WP Custom HTML Page to a release after 0.6.2. The authoritative record establishes the affected boundary but does not name the first fixed release. Review Author-created custom pages for scripts or unexpected markup before opening them in a privileged browser session.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N