CVE-2026-110507
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read. Users with the contributor role and above could read the content of other users' draft, pending, scheduled and private posts and pages.
Risk Assessment
Low-privileged users may access unpublished or private content, constituting a confidentiality breach.
Recommendation
Update the Page Builder by SiteOrigin plugin to version 2.38.0 or later.
Other vulnerabilities in Page Builder by SiteOrigin
See all- CVE-2026-110506Medium
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface. Users with the contributor role and above could perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.
- CVE-2026-97256High
Editor PHP Object Injection in Page Builder by SiteOrigin versions up to 2.36.0.
- CVE-2026-13295Medium
The Page Builder by SiteOrigin plugin for WordPress up to version 2.34.3 contains a stored XSS vulnerability via the panels_data parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary scripts that execute when users access the compromised page.
Original NVD description (English source)
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft, pending, scheduled and private posts and pages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS