CVE-2026-16942

Name of the Vulnerable Software and Affected Versions WP Custom HTML Page versions prior to 0.6.3

Description Insufficient sanitization of HTML stored through a custom page handler allows users with the Author role to perform a Stored Cross-Site Scripting (XSS) attack. This occurs because the plugin does not restrict the ability to post unfiltered HTML, enabling an attacker to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators.

Recommendations Update WP Custom HTML Page to a version newer than 0.6.2.