CVE-2026-16942: WP Custom HTML Page XSS Vulnerability

CVE-2026-16942 Overview

CVE-2026-16942 is a stored Cross-Site Scripting (XSS) vulnerability in the WP Custom HTML Page WordPress plugin through version 0.6.2. The plugin fails to sanitise HTML submitted through its custom page handlers and does not restrict this input to users with the unfiltered_html capability. Any authenticated user with the Author role can store arbitrary JavaScript that is served unescaped at a public URL. The payload executes in the browser of any visitor who loads that page, including administrators, enabling session theft or privilege escalation through actions performed in the administrator's context.

Critical Impact
An Author-level user can inject persistent JavaScript that executes for site visitors and administrators, enabling account takeover through the admin's authenticated session.

Affected Products

WP Custom HTML Page WordPress plugin, all versions through 0.6.2
WordPress installations where the plugin is active
Sites that permit user registration or grant Author-level access to untrusted users

Discovery Timeline

2026-08-05 - CVE-2026-16942 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-16942

Vulnerability Analysis

The WP Custom HTML Page plugin allows contributors to create pages containing raw HTML. WordPress restricts raw HTML posting to users with the unfiltered_html capability, which is granted to Administrators and Editors on single-site installations. This plugin bypasses that control by accepting HTML input from lower-privileged roles and rendering it verbatim on public URLs.

The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. Because the stored payload is served to any visitor, an attacker with Author privileges can target administrators who browse the site while authenticated. Script execution in the administrator's browser can trigger REST API calls, create new administrator accounts, install malicious plugins, or exfiltrate session cookies where HttpOnly is not enforced on all relevant tokens.

Root Cause

The plugin's custom page handler stores user-supplied HTML without calling WordPress sanitisation functions such as wp_kses_post() or wp_filter_post_kses(). It also omits a capability check for unfiltered_html before persisting the content. On output, the stored value is echoed to the response without escaping, allowing arbitrary <script> tags and event handler attributes to execute.

Attack Vector

Exploitation requires an authenticated Author account and one social interaction step: an administrator or visitor loading the crafted page. The attacker logs into WordPress, creates or edits a custom page through the plugin's interface, and submits a payload containing JavaScript. The payload persists in the database and executes each time the public URL is rendered. Additional technical detail is available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-16942

Indicators of Compromise

Custom page content containing <script> tags, on* event handlers, or javascript: URIs authored by non-privileged users
New administrator accounts created shortly after an Author user modified plugin content
Unexpected plugin or theme installations following visits by administrators to plugin-managed pages
Outbound requests from administrator browsers to unfamiliar domains after loading a WP Custom HTML page

Detection Strategies

Query the wp_posts table for entries created by Author-role users that contain HTML script or event-handler patterns
Review WordPress audit logs for content created or updated through the WP Custom HTML Page plugin endpoints
Deploy a Web Application Firewall (WAF) rule to inspect POST bodies to the plugin's save endpoints for script payloads
Monitor Content Security Policy (CSP) violation reports for inline script execution on plugin-served URLs

Monitoring Recommendations

Alert on privilege changes and administrator account creation events in the WordPress wp_users and wp_usermeta tables
Track HTTP responses served from plugin routes for unexpected <script> content using automated crawls
Correlate Author-level content submissions with subsequent administrative actions to surface exploitation chains

How to Mitigate CVE-2026-16942

Immediate Actions Required

Deactivate and remove the WP Custom HTML Page plugin until a patched release is published
Audit all custom pages created by the plugin and remove any content containing script tags or event handlers
Review user roles and revoke Author privileges from accounts that do not require content authoring
Rotate administrator passwords and invalidate active sessions if exploitation is suspected

Patch Information

As of the NVD publication date, no fixed version has been released. The vulnerability affects all versions through 0.6.2. Monitor the WPScan advisory for patch availability and apply the update immediately upon release.

Workarounds

Restrict the plugin's page-creation endpoints to Administrator role only using a capability-management plugin
Deploy a WAF rule that blocks HTML tags such as <script>, <iframe>, and on* attributes in requests to the plugin routes
Enforce a strict Content Security Policy that disallows inline scripts on pages served by the plugin
Disable new user registration or limit new registrations to the Subscriber role until the plugin is patched

bash

# Example: restrict access to Author-level accounts and disable open registration
wp option update users_can_register 0
wp option update default_role subscriber
wp plugin deactivate wp-custom-html-page