Stored XSS in Page Builder by SiteOrigin WordPress Plugin

Executive Summary

The Page Builder by SiteOrigin plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 2.34.3. This vulnerability arises because the plugin does not properly sanitize or escape input in the panels_data parameter. Authenticated users with Contributor-level access or higher can inject malicious web scripts into pages. These scripts execute whenever any user views the infected page.

The issue exists because Contributor-level users can pass nonce and edit_post capability checks for their own posts, and the panels_data is stored as post meta outside the usual WordPress filtering mechanisms. This allows unsanitized HTML content to be saved and later rendered directly on the frontend, enabling script injection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with Contributor-level access to inject malicious scripts into pages on a WordPress site using the Page Builder plugin. These scripts can execute in the browsers of users who visit the infected pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions.

Because the attack requires only Contributor-level access, which is a relatively low privilege, it increases the risk of exploitation from less trusted users. The impact includes loss of data integrity and confidentiality, as well as potential compromise of user accounts.

Useful 0 Not Useful 0