# CVE-2026-111122: SiteOrigin CSS stored DOM-based XSS via href parameter

Source: https://junglewise.ai/threats/cve-2026-111122-the-siteorigin-css-plugin-for-wordpress-is-vulnerable-to-stored  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111122 · Severity: high · CVSS 7.2 · Published 2026-10-16

The SiteOrigin CSS plugin for WordPress, used by many sites to customize site appearance, contains a vulnerability that allows unauthenticated attackers to inject malicious JavaScript code through comments. When an administrator reviews and approves a comment containing the attack and then opens the Visual Inspector, clicking the attacker's crafted link executes the injected code, potentially stealing credentials or compromising the site.

Vendors: [SiteOrigin](https://junglewise.ai/threats/vendors/siteorigin).

## Quick answers

**Is CVE-2026-111122 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111122 being exploited in the wild.

**How severe is CVE-2026-111122?** High severity, with a CVSS score of 7.2, published 16 October 2026.

**Which products and versions are affected?** SiteOrigin CSS up to and including 1.6.7.

**Is there a fix for CVE-2026-111122?** Yes: fixed in 1.6.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111122 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111122?** Check whether you run SiteOrigin CSS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.6.8

## Technical details

The vulnerability is a stored DOM-based cross-site scripting (XSS) flaw in the Visual Inspector feature, caused by insufficient input sanitization and output escaping of the 'href' parameter. An unauthenticated attacker can inject malicious JavaScript via comments; execution occurs in the inspector when an admin clicks a crafted link. The vulnerability affects all versions through 1.6.7 and is fixed in 1.6.8.

## Affected products

- SiteOrigin CSS up to and including 1.6.7

## Timeline

- 2026-10-16: disclosed
- 2026-10-08: patched

## References

- [https://github.com/siteorigin/so-css/compare/1.6.7...1.6.8](https://github.com/siteorigin/so-css/compare/1.6.7...1.6.8)
- [https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.7/js/inspector.js](https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.7/js/inspector.js)

## Related threats

- [SiteOrigin CSS plugin for WordPress Stored DOM-Based XSS](https://junglewise.ai/threats/cve-2026-107764-the-siteorigin-css-plugin-for-wordpress-is-vulnerable-to-stored)