Executive brief
A vulnerability in the Codeless Page Builder plugin for WordPress allows users with low-level access, such as contributors, to inject malicious scripts into website content. When a site administrator views this content, the script can execute in their browser, potentially leading to a full takeover of the website. This affects sites using version 1.1.4 or earlier of the plugin.
Technical details
The Codeless Page Builder plugin (<= 1.1.4) fails to sanitize or validate shortcode attributes, specifically within the 'cl_service' shortcode, before using them as HTML tag names during content rendering. An attacker with at least Contributor-level privileges can craft a malicious shortcode attribute containing arbitrary HTML and JavaScript. When a higher-privileged user, such as an administrator, previews or views the affected post, the payload executes within their session context. This vulnerability requires the Kirki Framework to be active to trigger the shortcode registration. As of the advisory date, no official patch has been released.
Affected products
- Codeless Codeless Page Builder <= 1.1.4
Timeline
- 2026-07-10: disclosed: Vulnerability reported to WPScan
- 2026-07-17: advisory: Public disclosure by WPScan
- 2026-08-01: other: CVE record published to NVD dataset