page_builder_by_siteorigin vulnerabilities
CVEs whose affected-version data names the page_builder_by_siteorigin package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-110506Medium· 6.8Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to…
▾ SunlitEPSS 0.32%via CVEORG
CVE-2026-110507Low· 2.7Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor r…
▾ SunlitEPSS 0.24%via CVEORG