CVE-2026-15234: Codeless Page Builder XSS Vulnerability

CVE-2026-15234 Overview

CVE-2026-15234 is a stored Cross-Site Scripting (XSS) vulnerability in the Codeless Page Builder WordPress plugin through version 1.1.4. The plugin fails to sanitize or validate a shortcode attribute before using it as an HTML tag name during content rendering. Contributor-level users can inject arbitrary HTML and JavaScript that executes when higher-privileged users, such as administrators, view the affected content. The flaw is categorized under CWE-79 and requires authenticated access combined with user interaction from the victim.

Critical Impact
Authenticated contributors can execute JavaScript in administrator sessions, enabling account takeover through session hijacking or forced administrative actions.

Affected Products

Codeless Page Builder WordPress plugin versions up to and including 1.1.4
WordPress sites allowing contributor-level or higher user registration
Any WordPress installation with the vulnerable plugin activated

Discovery Timeline

2026-08-01 - CVE-2026-15234 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-15234

Vulnerability Analysis

The vulnerability resides in the shortcode rendering logic of the Codeless Page Builder plugin. The plugin accepts a shortcode attribute and uses its value directly as an HTML tag name when constructing output markup. Because the attribute value is neither sanitized nor validated against an allowlist of safe tag names, an attacker can supply a value containing arbitrary HTML markup and inline JavaScript.

Exploitation requires an account with contributor privileges or higher. Contributors in WordPress can create posts but cannot publish them without review. When an editor or administrator previews or publishes the crafted post, the injected script executes in the reviewer's browser session.

The scope change reflected in the CVSS metrics indicates that code executes in the security context of a more privileged user than the attacker. This transforms a low-privilege posting capability into a path toward administrative account compromise.

Root Cause

The root cause is missing input validation on a shortcode attribute that is interpolated into an HTML tag position. Tag names must be strictly constrained to alphanumeric identifiers from a known-safe set. The plugin instead concatenates untrusted input directly into rendered HTML, breaking the boundary between data and markup structure.

Attack Vector

An attacker registers or compromises a contributor account. They author a post or page containing the vulnerable shortcode with a malicious attribute value. The payload embeds script content that executes when the post is rendered by a privileged reviewer. The injected JavaScript inherits the administrator's session and can create new administrator accounts, modify plugin settings, or exfiltrate authentication cookies.

See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-15234

Indicators of Compromise

Posts or pages authored by contributor accounts containing unusual shortcode attribute values with angle brackets, on* event handlers, or javascript: URIs
Unexpected creation of administrator accounts shortly after content review activity
Outbound requests from administrator browsers to unfamiliar domains immediately after loading plugin-rendered content
Modifications to wp_options or user role tables originating from administrator sessions during content preview

Detection Strategies

Review WordPress post_content for shortcodes associated with the Codeless Page Builder plugin containing tag-name attributes with non-alphabetic characters
Enable audit logging for role changes, user creation, and plugin configuration updates
Deploy a Web Application Firewall (WAF) rule to inspect POST bodies to /wp-admin/post.php for script fragments inside shortcode attributes
Correlate contributor content submissions with subsequent administrator session anomalies

Monitoring Recommendations

Monitor WordPress user role assignments and privilege escalations via database triggers or plugin-based audit logs
Track browser-originated administrative API calls for anomalous patterns during post preview workflows
Alert on new file uploads or theme edits following contributor content approvals

How to Mitigate CVE-2026-15234

Immediate Actions Required

Deactivate the Codeless Page Builder plugin until a patched release is available
Audit all existing contributor and author accounts and disable those that are unused or unrecognized
Review recent posts and pages for suspicious shortcode usage and remove untrusted content
Force password resets for administrator accounts that may have previewed contributor content

Patch Information

At the time of publication, no fixed version beyond 1.1.4 is referenced in the available advisory. Site operators should monitor the WPScan Vulnerability Report and the plugin's official distribution channel for a patched release. Apply the update immediately once available.

Workarounds

Restrict contributor and author role assignments to trusted users only, and disable open user registration
Deploy a WAF rule that blocks HTML tag characters within shortcode attribute values submitted to WordPress editing endpoints
Enforce a Content Security Policy (CSP) that disallows inline scripts on WordPress admin and preview pages
Remove the plugin entirely if it is not essential to site operation

bash

# Disable the plugin via WP-CLI until a patch is released
wp plugin deactivate codeless-page-builder

# Optionally remove the plugin files
wp plugin uninstall codeless-page-builder

# List all users with contributor or higher roles for review
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered