{
 "id": "WPSEC-2026-3008",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3008/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3008/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3008/index.md",
 "title": "SiteOrigin CSS <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSS Inspector Selector Handling",
 "description": "The SiteOrigin CSS plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via the CSS inspector in all versions up to, and including, 1.6.9. This is due to the inspector building selector strings from page elements' id and class attributes and from stylesheet rules, then passing them to jQuery's selector matching and wrapping functions, which can parse markup-like strings as HTML. This makes it possible for authenticated attackers, with contributor-level access and above, to plant crafted id or class attribute values in post content. Arbitrary web scripts then execute when an administrator opens the CSS inspector on that page.",
 "plugin": {
  "slug": "so-css",
  "name": "SiteOrigin CSS",
  "full_name": "SiteOrigin CSS",
  "wordpress_org": "https://wordpress.org/plugins/so-css/",
  "advisories_url": "https://wpsec.com/vuln/plugin/so-css/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/so-css"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.6.10",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.6.10"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.6.10",
 "remediation": "Update to 1.6.10 or later.",
 "fix_released": "2026-11-11T20:18:09+00:00",
 "published": "2026-11-12T20:47:03+00:00",
 "updated": "2026-11-12T17:11:39.505647+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3008/",
  "https://plugins.svn.wordpress.org/so-css/tags/1.6.10/",
  "https://wordpress.org/plugins/so-css/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/so-css",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}