SiteOrigin CSS <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSS Inspector Selector Handling
- ID
- WPSEC-2026-3008
- Plugin
- SiteOrigin CSS (so-css)
- Affected
- all versions before 1.6.10
- Remediation
- Update to 1.6.10 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- SiteOrigin CSS on WPSec AttackSurface
- Fix released
- Published
Description
The SiteOrigin CSS plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via the CSS inspector in all versions up to, and including, 1.6.9. This is due to the inspector building selector strings from page elements' id and class attributes and from stylesheet rules, then passing them to jQuery's selector matching and wrapping functions, which can parse markup-like strings as HTML. This makes it possible for authenticated attackers, with contributor-level access and above, to plant crafted id or class attribute values in post content. Arbitrary web scripts then execute when an administrator opens the CSS inspector on that page.
References
- https://wpsec.com/vuln/WPSEC-2026-3008/
- https://plugins.svn.wordpress.org/so-css/tags/1.6.10/
- https://wordpress.org/plugins/so-css/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS