CVE-2026-13295

Name of the Vulnerable Software and Affected Versions Page Builder by SiteOrigin versions prior to 2.34.4

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. This happens because the panels data parameter is stored as post meta, bypassing the wp kses fallback—a WordPress function used to filter HTML—which allows unsanitized WP Widget Custom HTML content to be rendered on the frontend when a user accesses the affected page.

Recommendations Update Page Builder by SiteOrigin to version 2.34.4 or later. As a temporary mitigation, restrict the panels data parameter or limit user permissions to prevent Contributor-level users from editing pages.