{"id":"CVE-2026-110506","title":"Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class","summary":"The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-79"],"product":"Page Builder by SiteOrigin","affected":["page_builder_by_siteorigin < 2.38.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-28T17:46:19.426866Z"},"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T17:58:07.498Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110506","references":[{"url":"https://wpscan.com/vulnerability/20bbee29-928f-4503-9cef-69f204441c8e/"}],"tags":["cve.org"],"epss":0.00317,"epssPercentile":0.24728,"ingestedAt":"2026-10-28T07:06:27.148Z","slug":"CVE-2026-110506","body":"## Overview\n\nThe Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.\n\n## Affected\n\n- `page_builder_by_siteorigin < 2.38.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":230794,"id":"CVE-2026-110506","ts":1793211384694,"field":"cvss","old":null,"new":"6.8"},{"seq":230793,"id":"CVE-2026-110506","ts":1793211384694,"field":"severity","old":"none","new":"medium"}]}