Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Page Builder by SiteOrigin 2.38.0 Clear all filters
TI-2026-81696 CVE-2026-110507 · GHSA-2m52-8826-2mqp

Page Builder by SiteOrigin: Contributor+ Reads Private Posts via Loop Widget

Priority LOW 13

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.0024 Published 2026-10-28 Fixed in 2.38.0 CWE-200
TI-2026-81695 CVE-2026-110506 · GHSA-mc48-45x9-jh54

Stored XSS in Page Builder by SiteOrigin via panels_info.class

Priority LOW 32

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00317 Published 2026-10-28 Fixed in 2.38.0 CWE-79