CVE-2026-110506mediumCWE-79

CVE-2026-110506: medium-severity vulnerability in Page Builder by SiteOrigin

Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class

Published

Follow this CVE+ Monitor Page Builder by SiteOrigin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.8epss 0.3%
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · Page Builder by SiteOrigin
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Page Builder by SiteOrigin

In the same product, most dangerous first.

CVE-2026-110507LOWPage Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query ArgumentsEPSS 0.2%