SecAlerts
s

siteorigin

Security Risk Profile

43
/100
medium

Security Risk Score

Comprehensive risk assessment based on 20 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from May 28, 2020 to present

20
Total CVEs
6
Critical+High
0
Exploited
5
Unpatched

Threat Assessment

Avg CVSS
6.9
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
5
Critical/High
Risk Level
43/100
medium
🆕 1Fresh (<7d)📈 1 in Last 30 Days

Severity Distribution

Critical
0
High
6
Medium
14
Low
0

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
9

Age Distribution

Common Weaknesses (CWE)

1
XSS
15
2
CSRF
2
3
Path Traversal
1

Most Affected Products

1. SiteOrigin SiteOrigin Widgets Bundle WordPress10
2. SiteOrigin Widgets Bundle6
3. SiteOrigin Page Builder Wordpress6
4. SiteOrigin Page Builder5
5. SiteOrigin Page Builder by SiteOrigin1

Recent Vulnerabilities

See more →
CVE-2026-97256
CVSS 7.2EPSS 1%high

WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability

Sep 30, 2026🔧 No Patch
CVE-2026-13295
CVSS 6.4medium

Page Builder by SiteOrigin <= 2.34.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter

Jun 27, 2026🔧 No Patch
CVE-2026-5070
CVSS 6.4EPSS 0%medium

Vantage <= 1.20.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Block Text Content

Apr 16, 2026🔧 No Patch
CVE-2025-5585
CVSS 6.4EPSS 0%medium

SiteOrigin Widgets Bundle <= 1.68.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-url` DOM Element Attribute

Jun 25, 2025🔧 No Patch
CVE-2025-1459
CVSS 6.4medium

Page Builder by SiteOrigin <= 2.31.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Mar 1, 2025
CVE-2024-12240
CVSS 6.4medium

Page Builder by SiteOrigin <= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter

Jan 14, 2025🔧 No Patch
CVE-2024-56026
CVSS 7.1high

WordPress Simple Proxy plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Jan 2, 2025🔧 No Patch
CVE-2024-54268
CVSS 8.8high

WordPress SiteOrigin Widgets Bundle plugin <= 1.64.0 - Broken Access Control vulnerability

Dec 13, 2024
CVE-2024-5901
CVSS 6.4EPSS 0%medium

SiteOrigin Widgets Bundle <= 1.62.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget

Jul 30, 2024🔧 No Patch
CVE-2024-5090
CVSS 6.4EPSS 0%medium

SiteOrigin Widgets Bundle <= 1.61.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via SiteOrigin Blog Widget

Jun 11, 2024🔧 No Patch

Monitor siteorigin in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.