CVE-2026-97256

HighCVSS 7.2

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

43th percentile - higher than 43% of all known CVEs

Summary

Editor PHP Object Injection in Page Builder by SiteOrigin versions up to 2.36.0.

Risk Assessment

An editor-level user can perform dangerous operations on the server, potentially leading to full site compromise.

Recommendation

Update Page Builder by SiteOrigin to a patched version.

Other vulnerabilities in Page Builder by SiteOrigin

CVE-2026-13295Medium
The Page Builder by SiteOrigin plugin for WordPress up to version 2.34.3 contains a stored XSS vulnerability via the panels_data parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary scripts that execute when users access the compromised page.

Original NVD description (English source)

Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS