Live › vulnerability › CVE-2026-110506
Go to dashboardThe Page Builder by SiteOrigin WordPress plugin does not sanitize a widget property before storing and displaying it in the editor. A contributor-level user can plant a script that runs in the browser of a higher-privileged user who opens the affected post.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Page Builder by SiteOrigin WordPress plugin before 2.38.0 where contributor-level or higher users can create or edit posts. The exposure matters most when editors or administrators open posts that contributors have edited. Sites without the plugin, or with it already at 2.38.0 or later, are not affected.
No product ranges from the sources yet.
2.38.0 are affected.Version header of wp-content/plugins/siteorigin-panels/siteorigin-panels.php.2.38.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.
This page as .md · .json · in your agent: get_signal("CVE-2026-110506")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.