BaseFortify

Executive Summary

CVE-2026-57780 is a Cross-Site Scripting (XSS) vulnerability in the WordPress Envision Page Builder Plugin, affecting versions up to and including 0.22.

This vulnerability occurs due to improper neutralization of input during web page generation, specifically a DOM-Based XSS issue.

It requires a privileged user, such as a Contributor or Developer, to perform an action like clicking a malicious link or submitting a form for the exploit to succeed.

If exploited, attackers can inject malicious scripts into the website, which execute when visitors access the site.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can allow attackers to inject malicious scripts into your website.

• These scripts could perform unwanted actions such as redirecting visitors to malicious sites or displaying unauthorized advertisements.
• Because the vulnerability requires a privileged user to trigger it, insider threats or compromised accounts increase risk.

The overall severity is considered low with a CVSS score of 6.5, but such XSS vulnerabilities are often targeted in mass-exploit campaigns affecting many websites.

As of the report date, no official patch is available, so immediate mitigation actions like updating the plugin or consulting a web developer are recommended.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate action is recommended to mitigate this vulnerability since there is no official patch available yet.

• Update the Envision Page Builder plugin to a version higher than 0.22 once a patch is released.
• Seek assistance from your hosting provider or a web developer to implement temporary mitigations or workarounds.
• Limit privileged user actions such as clicking unknown links or submitting untrusted forms to reduce exploitation risk.

Useful 0 Not Useful 0