Vulnerability in Codeless Page Builder Plugin Exposes Users to HTML Injection
CVE-2026-15234
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 1 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-15234?
The Codeless Page Builder plugin for WordPress fails to properly sanitize and validate shortcode attributes before utilizing them as HTML tag names. This critical flaw enables users with contributor-level access and above to inject malicious HTML and JavaScript code. The injected scripts execute in the sessions of higher-privileged users, including administrators, potentially leading to unauthorized access or actions within the WordPress site.
Affected Version(s)
Codeless Page Builder 0 <= 1.1.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.