CVE-2026-57337: Landing Page Builder XSS Vulnerability

CVE-2026-57337 Overview

CVE-2026-57337 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WordPress Landing Page Builder plugin (page-builder-add) in versions 1.5.3.5 and earlier. The flaw is classified under CWE-79 — Improper Neutralization of Input During Web Page Generation. Attackers can inject malicious scripts without authentication, executing arbitrary JavaScript in the context of a victim's browser after user interaction. The vulnerability affects site visitors, contributors, and administrators who load or preview the crafted content.

Critical Impact
Unauthenticated attackers can inject scripts that execute in the browser of any user viewing the affected page, enabling session theft, credential harvesting, and administrative account takeover.

Affected Products

WordPress Landing Page Builder plugin (page-builder-add) versions <= 1.5.3.5
WordPress sites with the plugin installed and activated
Any user browser session interacting with attacker-controlled plugin content

Discovery Timeline

2026-06-29 - CVE-2026-57337 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-57337

Vulnerability Analysis

The Landing Page Builder plugin fails to properly sanitize and escape user-supplied input before rendering it in the browser. This allows an unauthenticated attacker to craft a request containing malicious JavaScript. When a user interacts with the affected page, the script executes within the trusted origin of the WordPress site.

The vulnerability is a reflected or stored XSS variant requiring user interaction to trigger. The scope-changed nature of the flaw means the injected script operates in a security context different from the vulnerable component, amplifying its reach across the WordPress site. An EPSS probability of 0.146% indicates limited active exploitation prediction, but public plugin exposure keeps risk elevated.

Root Cause

The root cause is missing input validation and output encoding on parameters accepted by the plugin's page-building functionality. The plugin does not apply WordPress core sanitization functions such as sanitize_text_field(), wp_kses(), or esc_html() before echoing input into HTML contexts. This design gap allows attacker-controlled markup and script tags to be rendered verbatim.

Attack Vector

Exploitation occurs over the network without authentication. An attacker crafts a URL or HTTP request containing a JavaScript payload targeting a vulnerable plugin endpoint. The attacker then delivers the link to a victim through phishing, social media, or embedded content. When the victim visits the link, the browser executes the injected script under the WordPress site's origin, granting access to cookies, DOM contents, and any authenticated session state.

Refer to the Patchstack Vulnerability Report for the technical write-up of the affected parameters and payload behavior.

Detection Methods for CVE-2026-57337

Indicators of Compromise

Unexpected <script>, onerror=, onload=, or javascript: strings in HTTP request logs targeting page-builder-add plugin endpoints
Outbound connections from browsers to unknown domains after visiting WordPress pages using the plugin
New or modified administrator accounts on WordPress installations running Landing Page Builder <= 1.5.3.5
Anomalous session cookie access patterns from IPs geographically distant from legitimate users

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag HTML entity-encoded and URL-encoded script payloads in requests to WordPress plugin paths
Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts
Inspect WordPress wp-content/plugins/page-builder-add/ request logs for query strings containing HTML tag characters

Monitoring Recommendations

Correlate access logs with browser-side error telemetry to identify reflected payloads reaching users
Alert on administrative privilege changes shortly after page-builder endpoint access from unauthenticated sessions
Track plugin version inventory across all WordPress instances to identify unpatched deployments

How to Mitigate CVE-2026-57337

Immediate Actions Required

Identify all WordPress instances running Landing Page Builder (page-builder-add) at version 1.5.3.5 or earlier
Update the plugin to the latest patched version released by the vendor
Deactivate and remove the plugin on sites where an update is not yet available
Force a password reset for administrative accounts if suspicious activity is detected

Patch Information

Consult the Patchstack Vulnerability Report for vendor patch availability and the fixed plugin release version. Apply the update through the WordPress plugin dashboard or by replacing the plugin directory contents with the patched release.

Workarounds

Deploy a WAF ruleset that blocks HTTP requests containing script tags, event handlers, and JavaScript URIs targeting the plugin path
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Restrict access to landing page builder endpoints using IP allowlisting on the web server or reverse proxy
Disable the plugin until a verified patched version is installed

bash

# Configuration example: Apache mod_security rule to block script payloads to the vulnerable plugin path
SecRule REQUEST_URI "@contains /wp-content/plugins/page-builder-add/" \
  "chain,deny,status:403,id:1057337,msg:'Block XSS payload targeting CVE-2026-57337'"
SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni,t:htmlEntityDecode"