CVE-2026-110506
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface. Users with the contributor role and above could perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.
Risk Assessment
A malicious script may execute in the browser of an administrator or other privileged users, enabling session hijacking or actions performed on their behalf.
Recommendation
Update the Page Builder by SiteOrigin plugin to version 2.38.0 or later.
Other vulnerabilities in Page Builder by SiteOrigin
See all- CVE-2026-110507Low
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read. Users with the contributor role and above could read the content of other users' draft, pending, scheduled and private posts and pages.
- CVE-2026-97256High
Editor PHP Object Injection in Page Builder by SiteOrigin versions up to 2.36.0.
- CVE-2026-13295Medium
The Page Builder by SiteOrigin plugin for WordPress up to version 2.34.3 contains a stored XSS vulnerability via the panels_data parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary scripts that execute when users access the compromised page.
Original NVD description (English source)
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS