CVE-2026-110506 in Page Builder by SiteOrigin Plugin
Summary
by MITRE • 10/28/2026
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Page Builder by SiteOrigin prior to version 2.38.0 represents a significant security flaw within the WordPress ecosystem, specifically categorized as a stored cross-site scripting issue arising from inadequate input validation and output encoding mechanisms. This defect is rooted in the plugin's handling of widget properties during the content creation process. When users interact with the page builder interface to construct or modify web pages, specific data inputs are accepted without sufficient sanitization before being persisted into the database. Consequently, malicious scripts can be embedded directly within these stored values rather than being neutralized as harmless text strings. This architectural oversight allows an attacker who possesses at least contributor-level privileges to inject executable JavaScript code that remains active on the server side until manually removed or overwritten by a legitimate administrator.
From a technical perspective, this vulnerability aligns with CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The core issue lies in the failure to apply appropriate escaping functions when rendering user-supplied data back into the HTML context of the WordPress editor interface. Because the plugin stores these unsanitized values and subsequently outputs them without proper encoding, any browser session that loads the affected post triggers the execution of the embedded script. This behavior transforms a simple content editing feature into an attack vector capable of executing arbitrary code within the security context of the victim's active session. The persistence of this payload distinguishes it from reflected XSS attacks, as the malicious code is stored on the target server and delivered to multiple potential victims over time.
The operational impact of this vulnerability is particularly severe due to its reliance on privilege escalation dynamics within WordPress roles. While an attacker requires at least contributor status to exploit the flaw, the consequences are felt by users with higher privileges such as authors or administrators who regularly review or edit posts containing the malicious content. When a high-privileged user opens the compromised post in the page builder interface, their browser executes the injected script automatically. This execution grants the attacker the ability to perform actions on behalf of the victim, including stealing session cookies, capturing authentication tokens, manipulating DOM elements, or redirecting users to phishing sites. In environments where administrative access is critical for site management and security configuration, this breach can lead to complete compromise of the WordPress installation and potentially the underlying server infrastructure if further exploitation chains are developed.
In terms of threat modeling, this vulnerability maps directly to MITRE ATT&CK technique T1059.007, which covers JavaScript as a client-side scripting language used for execution within web browsers. The attack vector leverages the trusted relationship between the WordPress admin interface and the user's browser session to bypass same-origin policy restrictions implicitly granted by the login state of the victim. This enables persistent access or lateral movement if combined with other vulnerabilities such as cross-site request forgery weaknesses in plugin endpoints that accept unauthenticated requests for administrative actions. The stored nature of the payload ensures that even after the initial injection, the threat remains active until explicit remediation occurs, increasing the window of exposure and the likelihood of successful exploitation against unsuspecting administrators.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. Administrators should immediately upgrade Page Builder by SiteOrigin to version 2.38.0 or later where these sanitization issues have been addressed through rigorous input validation and output encoding protocols. For sites unable to update instantly, implementing a Web Application Firewall with rules capable of detecting and blocking malicious script injections in post content fields can provide temporary protection. Additionally, enforcing strict role-based access control policies ensures that only trusted users with verified identities are granted contributor-level or higher permissions, thereby reducing the attack surface available for initial exploitation. Regular security audits focusing on data flow from user input to database storage and subsequent rendering should be conducted to identify similar patterns of improper neutralization across other plugins and core functionalities within the WordPress environment.