{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asiteorigincsswordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:siteorigin:css:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-107764"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SiteOrigin CSS (\u003c= 1.6.7)"],"_cs_severities":["high"],"_cs_tags":["xss","web-application","wordpress"],"_cs_type":"threat","_cs_vendors":["SiteOrigin"],"content_html":"\u003cp\u003eThe SiteOrigin CSS plugin for WordPress (versions 1.6.7 and prior) contains a stored DOM-based Cross-Site Scripting (XSS) vulnerability. The flaw exists due to insufficient sanitization of the comment_author_url parameter. Attackers can leverage the WordPress esc_url() function's behavior of preserving HTML entity-encoded characters to bypass intended input protections. By injecting crafted entity-encoded payloads into the 'Website' field of a comment, an unauthenticated attacker can ensure the malicious script is stored in the database. When the page is subsequently rendered, the browser performs a DOM-decode operation, executing the injected markup. This poses a significant risk as it allows for unauthorized script execution in the context of any user session that visits the compromised page, potentially leading to session hijacking or unauthorized administrative actions.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the victim's browser. This can lead to account takeover, session theft, or the execution of malicious actions within the WordPress dashboard if an administrator views the crafted comment. The vulnerability affects all users running SiteOrigin CSS version 1.6.7 or earlier on their WordPress installations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the SiteOrigin CSS plugin to the latest version (post-1.6.7) to resolve the input sanitization flaw. Monitor web server logs for HTTP POST requests directed toward comment submission endpoints that contain unusually long or character-encoded 'url' or 'comment_author_url' parameters.\u003c/p\u003e\n","date_modified":"2026-10-16T06:26:38Z","date_published":"2026-10-16T06:26:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-siteorigin-css-xss/","summary":"The SiteOrigin CSS WordPress plugin contains a stored DOM-based XSS vulnerability via the 'url' parameter, allowing unauthenticated attackers to execute arbitrary web scripts.","title":"Stored DOM-Based Cross-Site Scripting in SiteOrigin CSS","url":"https://feed.craftedsignal.io/briefs/2026-10-siteorigin-css-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:siteorigin:css:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}