CVE-2026-97256

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read. Users with the contributor role and above could read the content of other users' draft, pending, scheduled and private posts and pages.

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface. Users with the contributor role and above could perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.

The Page Builder by SiteOrigin plugin for WordPress up to version 2.34.3 contains a stored XSS vulnerability via the panels_data parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary scripts that execute when users access the compromised page.