CVE-2026-110506

The Page Builder by SiteOrigin WordPress plugin (versions before 2.38.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because a widget property is neither sanitized nor escaped before being stored and subsequently rendered within the page builder interface. This specific ...

CVE-2026-110506 Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against...