Stored Cross-Site Scripting Vulnerability in Page Builder by SiteOrigin
CVE-2026-110506
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 28 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-110506?
The Page Builder by SiteOrigin plugin for WordPress prior to version 2.38.0 has a vulnerability that allows improper sanitization and escaping of widget properties. This shortcoming enables users with contributor roles and above to inject malicious scripts into the page builder interface, which can be executed when higher-privileged users access the affected post in the editor. As a result, this vulnerability could lead to serious security breaches, compromising user accounts and sensitive data.
Affected Version(s)
Page Builder by SiteOrigin 0 < 2.38.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.