PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-16942 WP Custom HTML Page CVE debrief

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators. This vulnerability allows for potential JavaScript execution in the context of the affected plugin, primarily impacting the integrity and confidentiality of affected systems. Defenders should verify plugin versions, review stored HTML content, and monitor for suspicious JavaScript activity to mitigate potential risks. The vulnerability is limited to stored HTML and does not involve remote code execution or SQL injection. Technical impact is limited to JavaScript execution. Administrators and users with the Author role in WordPress installations using the WP Custom HTML Page plugin should be aware of this vulnerability.

Vendor
WP Custom HTML Page
Product
WP Custom HTML Page
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-05
Original CVE updated
2026-08-26
Advisory published
2026-08-05
Advisory updated
2026-08-26

Who should care

Administrators and users with the Author role in WordPress installations using the WP Custom HTML Page plugin should be aware of this vulnerability. They should review plugin versions, restrict Author role permissions, and monitor for suspicious JavaScript activity. Security teams should prioritize patching or mitigating this vulnerability to prevent potential JavaScript execution.

Technical summary

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML. This allows users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators. The vulnerability is limited to stored HTML and does not involve remote code execution or SQL injection. Technical impact is limited to JavaScript execution in the context of the affected plugin.

Defensive priority

Users with the Author role can store JavaScript that executes for any visitor, including administrators.

Recommended defensive actions

  • Inventory and verify installed plugins
  • Restrict Author role permissions
  • Monitor for suspicious JavaScript activity
  • Update plugin to latest version if available
  • Review compensating controls for exposed systems
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions and retest remediated assets

Evidence notes

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML. This allows users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators. The plugin's behavior is limited to stored HTML and does not involve remote code execution or SQL injection. Defenders should verify plugin versions, review stored HTML content, and monitor for suspicious JavaScript activity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-16942 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-16942

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-16942 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-16942

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.