CyberRota Analysis
AI-GeneratedThe WP Custom HTML Page WordPress plugin versions up to 0.6.2 are vulnerable due to insufficient sanitization of HTML inputs, allowing users with the Author role to inject unfiltered JavaScript. This can lead to cross-site scripting (XSS) attacks, where malicious scripts execute in the browsers of visitors, including administrators. WordPress site administrators and security teams should prioritize addressing this vulnerability to protect against potential exploitation.
Original NVD Description
The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for any visitor, including administrators.