# CVE-2026-13295: SiteOrigin Page Builder Stored XSS via panels_data parameter

Source: https://junglewise.ai/threats/cve-2026-13295-siteorigin-page-builder-stored-xss-via-panels-data-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-27. Updated: 2026-06-27  
License: CC BY 4.0 with a link back

CVE-2026-13295 · Severity: medium · CVSS 6.4 · Published 2026-06-27

The Page Builder by SiteOrigin plugin for WordPress, which is used to create custom page layouts, contains a security flaw that allows users with basic 'Contributor' access to inject malicious scripts into pages. When other users or administrators view these affected pages, the scripts will execute automatically in their browsers. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.

Technologies: [SiteOrigin Page Builder by SiteOrigin](https://junglewise.ai/threats/technologies/page-builder-by-siteorigin). Vendors: [SiteOrigin](https://junglewise.ai/threats/vendors/siteorigin).

## Quick answers

**Is CVE-2026-13295 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13295 being exploited in the wild.

**How severe is CVE-2026-13295?** Medium severity, with a CVSS score of 6.4, published 27 June 2026.

**Which products and versions are affected?** SiteOrigin Page Builder by SiteOrigin up to, and including, 2.34.3.

**Is there a fix for CVE-2026-13295?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13295 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13295?** Check whether you run SiteOrigin Page Builder by SiteOrigin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'panels_data' parameter. The vulnerability exists because the plugin fails to sufficiently sanitize input and escape output when handling post metadata. Authenticated attackers with Contributor-level permissions can bypass standard WordPress 'unfiltered_html' restrictions because the data is stored as post meta, which does not trigger the 'wp_kses' fallback. This allows the injection of arbitrary web scripts (such as via WP_Widget_Custom_HTML content) that execute when a user views the compromised page. The issue is present in all versions up to and including 2.34.3.

## Affected products

- SiteOrigin (gpriday) Page Builder by SiteOrigin up to, and including, 2.34.3

## Timeline

- 2026-06-27: disclosed: Advisory published by Wordfence and NVD

## References

- [https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.34.1/inc/admin.php](https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.34.1/inc/admin.php)
- [https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.34.1/inc/admin.php](https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.34.1/inc/admin.php)
- [https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.34.1/inc/admin.php](https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.34.1/inc/admin.php)
- [https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.34.1/inc/renderer.php](https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.34.1/inc/renderer.php)
- [https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.34.3/inc/admin.php](https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.34.3/inc/admin.php)
- [https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.34.3/inc/admin.php](https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.34.3/inc/admin.php)
- [https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.34.3/inc/admin.php](https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.34.3/inc/admin.php)

## Related threats

- [Page Builder by SiteOrigin unauthorized access to private posts via Post Loop widget](https://junglewise.ai/threats/cve-2026-110507-the-page-builder-by-siteorigin-wordpress-plugin-before-2-38-0)
- [Page Builder by SiteOrigin PHP object injection](https://junglewise.ai/threats/cve-2026-97256-editor-php-object-injection-in-page-builder-by-siteorigin-2-36-0)