The SiteOrigin CSS plugin for WordPress has a stored cross‑site scripting flaw that originates from the href attribute of anchor tags in comments. Because the plugin does not sanitize or escape this input before rendering it in the Visual Inspector, an attacker can inject arbitrary JavaScript. When an authenticated administrator later opens the Visual Inspector and clicks the supplied link, the malicious script runs in the browser of any visitor who loads the affected page. This persistence across comment storage means the vulnerability can affect multiple users with a single payload, compromising confidentiality, integrity, and potentially the availability of the site.

The issue applies to all releases of the SiteOrigin CSS plugin up to and including version 1.6.7. Administrators running these or earlier versions are exposed; newer releases (starting with 1.6.8) contain the fix.

The CVSS score of 7.2 indicates high severity, mainly because the payload is stored and can reach many users. The EPSS score of 0.00236 (approximately 0.24%) suggests a low but non‑zero probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. It requires an unauthenticated comment submission and later administrator interaction with the Visual Inspector, which are common WordPress operations, making the attack path realistic in most environments.