We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

Page Builder by SiteOrigin Plugin Vulnerability (CVE-2026-13295)

Nick Paliughi
On this page

Security Alert Summary

The Page Builder by SiteOrigin plugin for WordPress (all versions up to and including 2.34.3) contains a stored cross-site scripting (XSS) vulnerability via the panels_data parameter. Authenticated users with Contributor-level access and above can store unsanitized HTML in post meta that is later rendered on the frontend, causing arbitrary scripts to execute when pages are viewed.

CVE Details

  • CVE ID: CVE-2026-13295
  • Affected component: Page Builder by SiteOrigin plugin for WordPress
  • Affected versions: All versions up to and including 2.34.3
  • Published date: June 27, 2026 at 8:16:44 AM UTC
  • Last modified: June 27, 2026 at 8:16:44 AM UTC
  • CVSS v3.1: Base score 6.4, MEDIUM — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • Authentication / privileges / user interaction: Requires authenticated user with low privileges (PR:L). The description states Contributor-level access and above can trigger the issue. User interaction is not required (UI:N).
  • Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
  • Weakness: CWE-79 (Cross-site Scripting)

Technical Details

This issue is a stored cross-site scripting vulnerability caused by insufficient input sanitization and output escaping for the panels_data parameter. The plugin stores the panels_data value as post meta, which places it outside WordPress’ unfiltered_html carve-out. As a result, unsanitized content (including content originating from WP_Widget_Custom_HTML) can be persisted and later rendered verbatim on the frontend.

The description notes that nonce and edit_post capability checks performed during save are satisfied by Contributor-level users for their own posts. Because those checks pass and no proper sanitization or escaping is applied to the stored panels_data, an authenticated user with Contributor privileges can inject arbitrary scripts into pages they are allowed to edit. When another user or visitor opens a page with the injected content, the script executes in the context of that page.

How This Could Impact Your Website

Consider a small team where a site owner delegates content creation to internal staff and external contributors. A contributor could insert a malicious script into a page they are allowed to edit. That script could run in the browsers of editors, administrators, or site visitors who view the injected page, potentially exposing limited confidential data available in the page context or altering visible content.

Realistic consequences include exposure of internal user information present on affected pages or injected content that increases the risk of targeted phishing and social engineering against staff or customers. The CVSS impact indicates low confidentiality and integrity impact rather than full site compromise, so consequences are likely limited to data visible or accessible within the page context and to actors who view the injected content.

If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles, especially Contributor-level accounts that can edit posts.
  • Enforce strong passwords and enable two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins.
  • Monitor site activity and logs for unusual behavior or unexpected changes to post content.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution Plugin Vulnerability (CVE-2026-11987)
Next Post
Stripe Payment Forms by WP Full Pay – Plugin Vulnerability (CVE-2026-12432)