CVE-2026-15234
Received Received - Intake

Cross-Site Scripting in Codeless Page Builder WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: WPScan

Description
The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of any higher-privileged user (such as an administrator) who views the content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-15234
EUVD
EUVD-2026-51715

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
codeless page_builder 1.1.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Codeless Page Builder WordPress plugin version 1.1.4 or earlier. It fails to properly sanitize or validate a shortcode attribute used as an HTML tag name. This allows users with contributor-level access or higher to inject arbitrary HTML and JavaScript code into content.

Detection Guidance

Check for the presence of the Codeless Page Builder WordPress plugin version 1.1.4 or below. Inspect WordPress posts or pages for unusual shortcode usage with untrusted attributes. Manually review rendered HTML output for unexpected script or HTML tags.

Impact Analysis

An attacker with contributor-level access could inject malicious scripts that execute when an administrator or higher-privileged user views the affected content. This could lead to unauthorized actions, data theft, or session hijacking on the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Organizations could face legal penalties or reputational damage if exploited.

Mitigation Strategies

Update the Codeless Page Builder plugin to the latest version if available. Disable the plugin temporarily if no update exists. Restrict contributor-level and above users from editing posts/pages. Monitor for suspicious HTML/JavaScript injection in content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15234. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart