The WP Custom HTML Page WordPress plugin through version 0.6.2 does not sanitize HTML stored via one of its custom page handlers and fails to restrict this capability to users permitted to post unfiltered HTML. Consequently, users with the Author role can inject JavaScript that is served unescaped at a public URL, leading to cross-site scripting (CWE-79). This vulnerability can result in script execution in the context of any visitor, including administrators.

An attacker with Author role privileges can inject malicious JavaScript code that executes in the browsers of visitors to the affected page, potentially leading to session hijacking, privilege escalation, or other attacks that rely on executing script in the context of the vulnerable site. The CVSS score of 5.4 (medium severity) reflects the network attack vector, low attack complexity, and limited privileges required, with impacts on confidentiality and integrity but no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author role users from accessing the vulnerable functionality or disable the WP Custom HTML Page plugin if possible. Avoid granting unfiltered HTML posting capabilities to users with limited trust.