CVE-2026-107764 gpriday CVE debrief

Who should care

Defenders responsible for WordPress installations with the SiteOrigin CSS plugin should assess exposure and prioritize verification and remediation efforts. This includes reviewing the plugin version, assessing the environment for potential exposure, and implementing compensating controls to detect and prevent exploitation. Security teams and vulnerability management teams should also review and update incident response plans to address potential exposure

Why it matters

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting, allowing unauthenticated attackers to inject arbitrary web scripts. Defenders should prioritize verifying and updating the plugin, assessing exposure, and implementing compensating controls.

• Unauthenticated attackers can inject arbitrary web scripts in pages
• Injected scripts execute whenever a user accesses an injected page
• Defenders must verify and update the SiteOrigin CSS plugin to prevent exploitation
• Exposure requires verification from official sources

Technical summary

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability exists due to the way WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.

Defensive priority

Defenders should prioritize verifying and updating the SiteOrigin CSS plugin to a version that addresses this vulnerability, assessing exposure in their environment, and implementing compensating controls to detect and prevent exploitation.

Recommended defensive actions

• Verify and update the SiteOrigin CSS plugin to a version that addresses this vulnerability
• Assess exposure in the environment and implement compensating controls to detect and prevent exploitation
• Monitor for suspicious activity and implement additional security measures as needed
• Review and update incident response plans to address potential exploitation
• Implement additional security controls to detect and prevent exploitation
• technicalSummary
• whoShouldCare

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source-specific vulnerability assessments. The vulnerability exists in all versions up to, and including, 1.6.7 of the SiteOrigin CSS plugin for WordPress. Defenders should verify the plugin version and assess exposure in their environment. The CVE Program and NVD entries are official sources for this vulnerability information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.