The WP Custom HTML Page plugin, up to version 0.6.2, fails to sanitize or filter stored HTML in its page handlers. Users with the Author role can store arbitrary JavaScript that is served unescaped from a public URL. The unsanitized code then runs in the browsers of any site visitor, including site administrators. This stored cross‑site scripting flaw can be used to hijack sessions, steal cookies, deface the site, or redirect users to malicious sites. The vulnerability directly maps to the classic stored XSS weakness (CWE‑79).

The affected product is the WordPress plugin “WP Custom HTML Page” version 0.6.2 and earlier. No specific vendor name is published, but all installations of this plugin running those versions are vulnerable if the Author role has access to the custom page editor.

There is no CVSS score or EPSS value available, and the flaw is not listed in CISA’s KEV catalog. Nonetheless, the flaw grants arbitrary JavaScript execution to any authenticated user with Author permissions, which is a high‑risk vector that can be easily exercised with minimal effort. The exploit conditions are straightforward: an attacker with Author privileges must submit a page containing malicious script, and the resulting URL is publicly accessible. Because the threat does not require additional software or network access, the likelihood of exploitation is high for sites that have retained insecure versions of the plugin.