PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-16942 WP Custom HTML Page CVE debrief

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators. This vulnerability allows for potential JavaScript execution in the context of the affected plugin, primarily impacting the integrity and confidentiality of affected systems. Defenders should verify plugin versions, review stored HTML content, and monitor for suspicious JavaScript activity to mitigate potential risks. The vulnerability is limited to stored HTML and does not involve remote code execution or SQL injection. Technical impact is limited to JavaScript execution. Administrators and users with the Author role in WordPress installations using the WP Custom HTML Page plugin should be aware of this vulnerability.

Vendor
WP Custom HTML Page
Product
WP Custom HTML Page
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-05
Original CVE updated
2026-08-05
Advisory published
2026-08-05
Advisory updated
2026-08-05

Who should care

Administrators and users with the Author role in WordPress installations using the WP Custom HTML Page plugin should be aware of this vulnerability. They should review plugin versions, restrict Author role permissions, and monitor for suspicious JavaScript activity. Security teams should prioritize patching or mitigating this vulnerability to prevent potential JavaScript execution.

Technical summary

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML. This allows users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators. The vulnerability is limited to stored HTML and does not involve remote code execution or SQL injection. Technical impact is limited to JavaScript execution in the context of the affected plugin.

Defensive priority

Users with the Author role can store JavaScript that executes for any visitor, including administrators.

Recommended defensive actions

  • Inventory and verify installed plugins
  • Restrict Author role permissions
  • Monitor for suspicious JavaScript activity
  • Update plugin to latest version if available
  • Review compensating controls for exposed systems
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions and retest remediated assets

Evidence notes

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML. This allows users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators. The plugin's behavior is limited to stored HTML and does not involve remote code execution or SQL injection. Defenders should verify plugin versions, review stored HTML content, and monitor for suspicious JavaScript activity.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T07:16:36.770Z and has not been modified since then.