CVE-2026-13295: Page Builder by SiteOrigin Stored XSS in panels_data Parameter

Technical summary

CVE-2026-13295 is a Stored XSS vulnerability in Page Builder by SiteOrigin caused by insufficient input sanitization and output escaping of the panels_data parameter. The vulnerability exists because: (1) the plugin stores the panels_data value as WordPress post meta rather than within the post_content field, bypassing WordPress's unfiltered_html capability restrictions and wp_kses sanitization fallback; (2) nonce and edit_post capability checks during save are satisfied by Contributor-level users modifying their own posts; (3) WP_Widget_Custom_HTML content within panels_data is persisted and rendered verbatim on the frontend without sanitization. The attack vector is network-based, requires low attack complexity, and necessitates authenticated access at Contributor level or above.

Business impact

Organizations running WordPress sites with Page Builder by SiteOrigin are at risk of session hijacking, credential theft, malware distribution, and defacement. A Contributor can silently inject malicious scripts into pages they create, affecting all site visitors including administrators. This undermines content integrity and visitor trust. The vulnerability is particularly concerning for multi-author sites, agencies managing client content, and editorial platforms where Contributor access is common.

Affected systems

Page Builder by SiteOrigin plugin versions up to and including 2.34.3 are affected. The vulnerability requires WordPress environments with the plugin active and Contributor-level or higher user accounts present. Sites limiting post creation to Editors and Administrators only face reduced risk, though the vulnerability still exists technically.

Exploitability

Exploitation requires authenticated access at Contributor level or above—a common permission tier in multi-author WordPress installations. No user interaction is required beyond the initial page visit by victims. The attack is straightforward: a Contributor crafts a page with malicious JavaScript in the panels_data parameter, saves it, and the script executes when site visitors view that page. The low attack complexity and lack of user interaction requirements make this readily exploitable by insiders or compromised accounts with Contributor permissions.

Remediation

Update the Page Builder by SiteOrigin plugin to a patched version beyond 2.34.3 as soon as the vendor releases one. Verify the specific patch version in the official WordPress plugin repository or vendor advisory. As an interim mitigation, restrict Contributor-level access to trusted users only, or temporarily disable the plugin if it is not actively used. Review existing pages created by Contributors for suspicious content.

Patch guidance

Monitor the SiteOrigin plugin's official WordPress repository page and security advisories for a patched release. Once available, apply the update through the WordPress admin dashboard (Plugins > Installed Plugins > Update). Test the update in a staging environment first. After patching, audit recent pages created by Contributor-level users to detect any injected malicious content. Verify the patch version against the vendor's advisory to confirm it addresses CVE-2026-13295.

Detection guidance

Review post meta entries for the panels_data parameter, particularly those containing JavaScript keywords (script, onclick, onerror, onload, etc.) in pages created or modified by Contributor-level users. Enable WordPress security audit logging to track post creation and modification events. Monitor browser console errors and network requests when visiting pages built with Page Builder, as injected scripts may generate observable indicators. Search page source code for unexpected script tags or event handlers within rendered page builder blocks. Security plugins with code inspection capabilities can help identify stored XSS payloads in post meta.

Why prioritize this

Although not yet in CISA's KEV catalog, this vulnerability warrants prompt prioritization due to CVSS 6.4 (MEDIUM) severity, the widespread use of Page Builder by SiteOrigin (millions of WordPress installations), low exploitation complexity, and the persistence of stored XSS that affects all site visitors. Multi-author sites and agencies should prioritize higher due to greater exposure to Contributor-level users.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects: network-based attack vector (AV:N), low attack complexity (AC:L), requirement for low-privilege authenticated access (PR:L), no user interaction needed for execution (UI:N), and impact scope change (S:C) affecting the confidentiality and integrity of other users' sessions (C:L, I:L) without direct availability impact (A:N). The score appropriately captures that while exploitability is straightforward and the scope extends beyond the vulnerable component, the direct impact per instance is limited to individual page views rather than wholesale system compromise.

Frequently asked questions