What is GHSA-34jf-wc5v-9rcm?

GHSA-34jf-wc5v-9rcm is a security advisory published by GitHub Security Advisories with Medium severity. The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one...

Which CVE IDs does GHSA-34jf-wc5v-9rcm cover?

GHSA-34jf-wc5v-9rcm covers the following CVE IDs: CVE-2026-16942. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-34jf-wc5v-9rcm?

GHSA-34jf-wc5v-9rcm has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-34jf-wc5v-9rcmMediumCVSS 5.4

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one...

Vendor

GitHub Security Advisories

Published

August 5, 2026

Last Modified

August 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-16942 →

📋 Description

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16942
https://wpscan.com/vulnerability/cda6b957-2013-4707-a5b5-5ddc04be2f6a
https://github.com/advisories/GHSA-34jf-wc5v-9rcm