CVE-2026-107764Published
SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-107764 · Microsoft / collected KEV context
cve-program · CVE-2026-107764
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ff9652-1b45-43d6-949a-92bfeaee96d3?source=cve
- https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/js/inspector.js#L280
- https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/so-css.php#L69
- https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/so-css.php#L899
- https://github.com/siteorigin/so-css/compare/1.6.7...1.6.8
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.