{"id":"CVE-2026-110506","kind":"vulnerability","aliases":["CVE-2026-110506"],"related":[],"title":"WordPress Page Builder plugin: stored XSS via widget property before 2.38.0","description":"The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.","summary":"The Page Builder by SiteOrigin WordPress plugin does not sanitize a widget property before storing and displaying it in the editor. A contributor-level user can plant a script that runs in the browser of a higher-privileged user who opens the affected post.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","siteorigin-page-builder","wordpress","wordpress-plugin"],"not_affected_if":["no-contributor-accounts","plugin-at-2.38.0-or-later"],"how_to_check":"- Check the installed version of the Page Builder by SiteOrigin plugin in the WordPress admin plugins list; versions before `2.38.0` are affected.\n- Review the plugin's version in the `Version` header of `wp-content/plugins/siteorigin-panels/siteorigin-panels.php`.","fix":"- Update the Page Builder by SiteOrigin plugin to `2.38.0` or later.","status":"open","published_at":"2026-10-28T06:16:33+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","triaged_at":"2026-10-28T06:32:44+00:00","updated_at":"2026-10-28T06:32:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Page Builder by SiteOrigin plugin to `2.38.0` or later.","reach":"network","title":"WordPress Page Builder plugin: stored XSS via widget property before 2.38.0","impact":"medium","summary":"The Page Builder by SiteOrigin WordPress plugin does not sanitize a widget property before storing and displaying it in the editor. A contributor-level user can plant a script that runs in the browser of a higher-privileged user who opens the affected post.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","siteorigin-page-builder"],"confidence":0.7,"needs_auth":"yes","worst_case":"Script runs in an administrator's editor session, enabling account takeover.","analyst_note":"","how_to_check":"- Check the installed version of the Page Builder by SiteOrigin plugin in the WordPress admin plugins list; versions before `2.38.0` are affected.\n- Review the plugin's version in the `Version` header of `wp-content/plugins/siteorigin-panels/siteorigin-panels.php`.","needs_analyst":false,"not_affected_if":["plugin-at-2.38.0-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the Page Builder by SiteOrigin WordPress plugin before 2.38.0 where contributor-level or higher users can create or edit posts. The exposure matters most when editors or administrators open posts that contributors have edited. Sites without the plugin, or with it already at 2.38.0 or later, are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000621,"input_tokens":3326,"output_tokens":577,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110506':14A,17A '-2026':13A,16A '2.38.0':11A,81C 'affect':71B,127C 'allow':103C 'attack':118C 'browser':61B 'builder':3A,22B,29B,75C,99C 'contributor':50B,107C 'contributor-level':49B 'could':102C 'cross':115C 'cross-sit':114C 'cve':12A,15A 'display':43B 'editor':47B,131C 'escap':86C 'higher':65B,121C 'higher-privileg':64B,120C 'interfac':100C 'level':51B 'open':69B,125C 'output':94C 'packag':18B 'page':2A,21B,28B,74C,98C 'perform':112C 'plant':54B 'plugin':4A,26B,33B,79C 'post':72B,128C 'privileg':66B,122C 'properti':9A,39B,89C 'role':108C 'run':58B 'sanit':36B,84C 'script':56B,117C 'site':116C 'siteorigin':20B,31B,77C 'siteorigin-page-build':19B 'store':5A,41B,91C,113C 'user':52B,67B,104C,123C 'via':7A 'widget':8A,38B,88C 'wordpress':1A,23B,25B,32B,78C 'wordpress-plugin':24B 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Page Builder by SiteOrigin WordPress plugin before 2.38.0 where contributor-level or higher users can create or edit posts. The exposure matters most when editors or administrators open posts that contributors have edited. Sites without the plugin, or with it already at 2.38.0 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110506","severity":null,"published_at":"2026-10-28T06:16:33+00:00","modified_at":"2026-10-28T06:16:33+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","fetched_at":"2026-10-28T06:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}