CVE-2026-110506: Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class

Q: Who can exploit this issue and who is at risk from the payload?

A user with the WordPress contributor role or higher can store a malicious payload. The payload affects higher-privileged users who open the affected post in the page builder editor.

Q: What interaction is required for exploitation to have an effect?

The attacker must be able to create or modify content using the plugin and supply a malicious widget property. A higher-privileged user must then open the affected post in the editor, where the stored payload is output.

Q: Which plugin versions are affected?

Versions of Page Builder by SiteOrigin before 2.38.0 are affected. Version 2.38.0 is not identified as affected by the provided information.

Published Oct 28, 2026

Updated

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.

Affected Software

1 affected component

SiteOrigin Page Builder by SiteOrigin<2.38.0

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue and who is at risk from the payload?

A user with the WordPress contributor role or higher can store a malicious payload. The payload affects higher-privileged users who open the affected post in the page builder editor.

What interaction is required for exploitation to have an effect?

The attacker must be able to create or modify content using the plugin and supply a malicious widget property. A higher-privileged user must then open the affected post in the editor, where the stored payload is output.

Which plugin versions are affected?

Versions of Page Builder by SiteOrigin before 2.38.0 are affected. Version 2.38.0 is not identified as affected by the provided information.

CVE-2026-110506: Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue and who is at risk from the payload?

What interaction is required for exploitation to have an effect?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue and who is at risk from the payload?

What interaction is required for exploitation to have an effect?

Which plugin versions are affected?