CVE-2026-13295
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk15th percentile — higher than 15% of all known CVEs
Summary
The Page Builder by SiteOrigin plugin for WordPress up to version 2.34.3 contains a stored XSS vulnerability via the panels_data parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary scripts that execute when users access the compromised page.
Risk Assessment
An attacker can inject malicious JavaScript that executes in visitors' browsers, potentially leading to session theft, redirects, or defacement. The vulnerability is especially dangerous because Contributors can attack their own posts without privilege escalation.
Recommendation
Immediately update the Page Builder by SiteOrigin plugin to the latest available version. If an update is not possible, restrict Contributor and higher privileges to the minimum and consider temporarily disabling the plugin.
Original NVD description (English source)
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Parameter in all versions up to, and including, 2.34.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the nonce and edit_post capability checks enforced during save are both satisfied by Contributor-level users for their own posts, and the panels_data value is stored as post meta — outside the scope of WordPress's unfiltered_html carve-out — meaning no wp_kses fallback prevents the unsanitized WP_Widget_Custom_HTML content from being persisted and later rendered verbatim on the frontend.