The SiteOrigin CSS plugin for WordPress suffers from a stored DOM‑based XSS flaw. The flaw resides in the comment author URL field, which is saved without sufficient sanitization or escaping. An attacker who can post a comment can embed an entity‑encoded malicious payload that survives storage and is later interpreted by the browser as executable markup. This allows the injection of arbitrary scripts that run in the context of any user who views the page, enabling session hijacking, cookie theft, defacement or delivery of additional malware.

All versions of the SiteOrigin CSS WordPress plugin up to and including 1.6.7 are affected. No other versions are listed as vulnerable. Administrators who run WordPress sites with SiteOrigin CSS should verify the plugin version.

The vulnerability carries a CVSS score of 7.2, indicating a high severity. EPSS information is not available and it is not listed in the CISA KEV catalog, but because the attack does not require authentication and the payload is stored permanently, the likelihood of exploitation is significant. The vector is likely the public comment interface, making the flaw readily exploitable by anyone who can add a comment to a post or page.