CVE-2026-13295: SiteOrigin Page Builder XSS Vulnerability

CVE-2026-13295 Overview

CVE-2026-13295 is a Stored Cross-Site Scripting (XSS) vulnerability in the Page Builder by SiteOrigin plugin for WordPress. The flaw affects all versions up to and including 2.34.3. It stems from insufficient input sanitization and output escaping of the panels_data parameter. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views an affected page, including administrators. The issue is classified as improper neutralization of input during web page generation [CWE-79].

Critical Impact
Low-privileged Contributor users can persist JavaScript that runs in higher-privileged users' browsers, enabling session theft, forced administrative actions, and site defacement.

Affected Products

Page Builder by SiteOrigin plugin for WordPress
All versions up to and including 2.34.3
WordPress sites permitting Contributor-level (or higher) accounts to author posts

Discovery Timeline

2026-06-27 - CVE-2026-13295 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13295

Vulnerability Analysis

The Page Builder by SiteOrigin plugin stores layout definitions in the panels_data post meta field. When a Contributor-level user saves a post, the plugin's save handler in inc/admin.php verifies the nonce and the edit_post capability. Both checks pass for a Contributor editing their own draft. The plugin then persists panels_data without applying wp_kses sanitization. Because post meta lives outside WordPress's unfiltered_html carve-out, the standard fallback that normally strips dangerous markup from Contributor input never runs. When an editor or administrator previews or publishes the post, the renderer in inc/renderer.php outputs widget content — including WP_Widget_Custom_HTML payloads — verbatim to the frontend, executing the attacker-controlled script.

Root Cause

The root cause is missing sanitization of a structured post meta field containing widget HTML. The plugin trusts that WordPress's built-in unfiltered_html restriction will filter Contributor input, but that protection applies only to post content, not post meta. No plugin-level wp_kses pass or output escaping compensates for the gap, allowing raw <script> markup embedded in a Custom HTML widget to be stored and later rendered.

Attack Vector

An authenticated Contributor crafts a panels_data payload containing a WP_Widget_Custom_HTML widget whose content field includes JavaScript. The attacker saves the post through the standard editor interface. When a reviewer, editor, or administrator opens the post on the frontend, the injected script executes in their authenticated session. This provides a path to hijack privileged sessions, create administrator accounts, or perform Cross-Site Request Forgery against the site owner.

No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Report and the SiteOrigin Panels renderer source for the affected code paths.

Detection Methods for CVE-2026-13295

Indicators of Compromise

Post meta entries named panels_data containing <script>, onerror=, onload=, or javascript: substrings within widget content fields.
Recent post revisions authored by Contributor-level accounts that contain SiteOrigin Custom HTML widgets.
Unexpected outbound requests from administrator browser sessions shortly after previewing Contributor-authored pages.

Detection Strategies

Query the wp_postmeta table for rows where meta_key = 'panels_data' and inspect serialized widget payloads for script-like content.
Review WordPress user role assignments and audit which accounts hold Contributor or higher privileges.
Correlate post save events with subsequent administrator page views to identify potential victim sessions.

Monitoring Recommendations

Enable a web application firewall rule set that flags stored XSS payloads in POST requests to /wp-admin/post.php.
Log all changes to panels_data post meta and alert on entries containing HTML event handlers or script tags.
Monitor for creation of new administrator accounts or role escalations following Contributor post publication.

How to Mitigate CVE-2026-13295

Immediate Actions Required

Update the Page Builder by SiteOrigin plugin to a version later than 2.34.3 as soon as a fixed release is available.
Audit all Contributor and Author accounts and remove or downgrade any that are inactive or unnecessary.
Inspect existing panels_data post meta for injected script content and sanitize or delete affected entries.

Patch Information

The SiteOrigin Panels changeset 3585987 tracks the vendor's remediation work. Administrators should apply the latest available plugin release through the WordPress plugin manager and verify the installed version exceeds 2.34.3.

Workarounds

Restrict post creation privileges so untrusted users do not hold Contributor-level access.
Deploy a WAF rule that blocks <script> and event-handler patterns in panels_data form fields submitted to wp-admin.
Disable the Custom HTML widget within SiteOrigin Page Builder configuration until the plugin is patched.

bash

# Example WP-CLI audit for suspicious panels_data entries
wp db query "SELECT post_id, LEFT(meta_value, 200) AS preview \
  FROM wp_postmeta \
  WHERE meta_key = 'panels_data' \
    AND (meta_value LIKE '%<script%' \
      OR meta_value LIKE '%onerror=%' \
      OR meta_value LIKE '%javascript:%');"