CVE-2024-2202

CVE-2024-2202 affects Page Builder by SiteOrigin for WordPress. It is a Stored XSS via the legacy Image widget in all versions up to 2.29.6, exploitable by authenticated users with contributor+ access to inject scripts executed when users view the affected pages. A fix exists in 2.29.7; update to...

CVE-2025-1459

CVE-2025-1459 describes a stored XSS in the WordPress Page Builder by SiteOrigin plugin. Affected: Page Builder by SiteOrigin (WP plugin) up to version 2.31.4. Root cause: insufficient input sanitization and output escaping in the Embedded Video (PB) widget, enabling authenticated attackers with ...

CVE-2024-4361

CVE-2024-4361 affects Page Builder by SiteOrigin for WordPress. It is a Stored XSS via the siteorigin_widget shortcode in all versions up to 2.29.15, exploitable by authenticated attackers with contributor-level access or higher. Connected documents confirm the vulnerability and indicate a patch ...

CVE-2020-13642

The CVE concerns the WordPress Plugin “Page Builder by SiteOrigin” (SiteOrigin Page Builder) prior to version 2.10.16. The root cause is missing nonce verification in action_builder_content, which enables forged admin-origin requests. The related panels_data ($_POST) handling can allow malicious ...

CVE-2020-13643

CVE-2020-13643 affects the WordPress plugin SiteOrigin Page Builder (before 2.10.16). The root cause is the live editor feature not performing nonce verification, allowing forged requests on behalf of an administrator. The vulnerable vector centers on the live_editor_panels_data in $_POST, which ...

CVE-2024-12240

CVE-2024-12240 is a Stored XSS vulnerability in Page Builder by SiteOrigin for WordPress, affecting all versions up to 2.31.0. The issue arises from insufficient input sanitization and output escaping in the row label parameter, enabling authenticated attackers with Contributor+ rights to inject ...