CVE-2026-107764: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in gpriday SiteOrigin CSS

CVE-2026-107764 is a stored DOM-based cross-site scripting vulnerability in the SiteOrigin CSS WordPress plugin (versions up to and including 1.6.7). The flaw exists because the 'url (comment_author_url)' parameter is not properly sanitized or escaped, allowing attackers to inject arbitrary scripts. The WordPress esc_url() function preserves HTML entity-encoded characters, enabling a crafted payload in the comment 'Website' field to be stored and later decoded by the browser into executable markup, leading to script execution in the context of the affected site.

An unauthenticated attacker can inject malicious scripts into pages via the vulnerable parameter, which execute in the browsers of users who visit those pages. This can lead to information disclosure and integrity impacts, such as theft of user credentials or session tokens. The CVSS score of 7.2 (high severity) reflects the network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity without availability impact.

No official patch or fix is currently available as per the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or restricting the use of the vulnerable parameter or plugin, and monitor for updates from the vendor.