# SiteOrigin CSS <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSS Inspector Selector Handling

- **ID:** WPSEC-2026-3008
- **Plugin:** SiteOrigin CSS (`so-css`), https://wordpress.org/plugins/so-css/
- **Affected versions:** all versions before 1.6.10
- **Fixed in:** 1.6.10 (Update to 1.6.10 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/so-css
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3008/

## Description

The SiteOrigin CSS plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via the CSS inspector in all versions up to, and including, 1.6.9. This is due to the inspector building selector strings from page elements' id and class attributes and from stylesheet rules, then passing them to jQuery's selector matching and wrapping functions, which can parse markup-like strings as HTML. This makes it possible for authenticated attackers, with contributor-level access and above, to plant crafted id or class attribute values in post content. Arbitrary web scripts then execute when an administrator opens the CSS inspector on that page.

## References

- https://wpsec.com/vuln/WPSEC-2026-3008/
- https://plugins.svn.wordpress.org/so-css/tags/1.6.10/
- https://wordpress.org/plugins/so-css/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3008/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.