Junglewise Threat Intelligence

CVE-2026-13295: SiteOrigin Page Builder Stored XSS via panels_data parameter

CVE-2026-13295 · Severity: medium · CVSS 6.4 · Published 2026-06-27

Executive brief

The Page Builder by SiteOrigin plugin for WordPress, which is used to create custom page layouts, contains a security flaw that allows users with basic 'Contributor' access to inject malicious scripts into pages. When other users or administrators view these affected pages, the scripts will execute automatically in their browsers. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.

Technical details

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'panels_data' parameter. The vulnerability exists because the plugin fails to sufficiently sanitize input and escape output when handling post metadata. Authenticated attackers with Contributor-level permissions can bypass standard WordPress 'unfiltered_html' restrictions because the data is stored as post meta, which does not trigger the 'wp_kses' fallback. This allows the injection of arbitrary web scripts (such as via WP_Widget_Custom_HTML content) that execute when a user views the compromised page. The issue is present in all versions up to and including 2.34.3.

Affected products

  • SiteOrigin (gpriday) Page Builder by SiteOrigin up to, and including, 2.34.3

Timeline

  • 2026-06-27: disclosed: Advisory published by Wordfence and NVD

References