CVE-2026-13295
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Page Builder by SiteOrigin plugin for WordPress up to version 2.34.3 contains a stored XSS vulnerability via the panels_data parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary scripts that execute when users access the compromised page.
Risk Assessment
An attacker can inject malicious JavaScript that executes in visitors' browsers, potentially leading to session theft, redirects, or defacement. The vulnerability is especially dangerous because Contributors can attack their own posts without privilege escalation.
Recommendation
Immediately update the Page Builder by SiteOrigin plugin to the latest available version. If an update is not possible, restrict Contributor and higher privileges to the minimum and consider temporarily disabling the plugin.
Other vulnerabilities in Page Builder by SiteOrigin
See all- CVE-2026-110507Low
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read. Users with the contributor role and above could read the content of other users' draft, pending, scheduled and private posts and pages.
- CVE-2026-110506Medium
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface. Users with the contributor role and above could perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.
- CVE-2026-97256High
Editor PHP Object Injection in Page Builder by SiteOrigin versions up to 2.36.0.
Original NVD description (English source)
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Parameter in all versions up to, and including, 2.34.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the nonce and edit_post capability checks enforced during save are both satisfied by Contributor-level users for their own posts, and the panels_data value is stored as post meta — outside the scope of WordPress's unfiltered_html carve-out — meaning no wp_kses fallback prevents the unsanitized WP_Widget_Custom_HTML content from being persisted and later rendered verbatim on the frontend.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS