CVE-2026-111122Published
SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111122 · Microsoft / collected KEV context
cve-program · CVE-2026-111122
- https://www.wordfence.com/threat-intel/vulnerabilities/id/97742c7c-4957-4597-9cc0-c9594e8c8482?source=cve
- https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.7/js/inspector.js#L280
- https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.7/js/inspector.js#L276
- https://github.com/siteorigin/so-css/compare/1.6.7...1.6.8
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.