The WP Custom HTML Page plugin through version 0.6.2 contains a CWE-79 Cross-Site Scripting vulnerability. It does not sanitize HTML input stored through one of its custom page handlers and does not restrict this functionality to users authorized to post unfiltered HTML. This allows users with the Author role to store malicious JavaScript code that is delivered unescaped to public URLs, enabling script execution in the context of any visitor's browser, including those of administrators.

This vulnerability allows users with Author-level permissions to inject and execute arbitrary JavaScript code in the browsers of site visitors, including administrators. This can lead to session hijacking, privilege escalation, or other malicious actions performed in the context of the affected website. The impact is significant because it bypasses intended role-based restrictions and exposes the site to client-side attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author role users from accessing the vulnerable functionality or disable the WP Custom HTML Page plugin. Monitor official vendor channels for updates and apply patches promptly once released.