Unscored severity · published Oct 28, 2026
CVE-2026-110506
Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class
New
–
CVSS
–
EPSS
No
On KEV
Description
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PB
Page Builder by SiteOrigin ·
before 2.38.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110506
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110506
exploit
https://wpscan.com/vulnerability/20bbee29-928f-4503-9cef-69f204441c8e/
More from Page Builder by SiteOrigin
–
CVE-2026-110507
Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments