EUVD-2026-51715
GHSA-5wxq-4r9f-r3xm
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Contributor credentials required (PR:L), admin must view content (UI:R), impact crosses to admin session causing scope change (S:C); no availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of any higher-privileged user (such as an administrator) who views the content.
AnalysisAI
Stored cross-site scripting in the Codeless Page Builder WordPress plugin (versions through 1.1.4) allows contributor-level users to inject arbitrary HTML and JavaScript by supplying unsanitized input as an HTML tag name via a shortcode attribute. When a higher-privileged user such as an administrator views the crafted content, the payload executes in their browser session, enabling session hijacking or unauthorized administrative actions. A public exploit proof-of-concept is available via WPScan; exploitation probability is low per EPSS (0.15%, 5th percentile), suggesting opportunistic rather than widespread active targeting.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) describes the root cause: the plugin uses a contributor-supplied shortcode attribute directly as an HTML tag name when rendering page content, without sanitization or validation. This is a structural DOM injection variant of stored XSS - rather than inserting content between tags, the attacker controls the tag name itself, which bypasses naive attribute-level sanitization. The affected CPE is cpe:2.3:a:unknown:codeless_page_builder:*:*:*:*:*:*:*:*, with the 'unknown' vendor identifier in NVD indicating limited CPE curation. The WordPress shortcode system parses [shortcode attr='value'] syntax server-side; flaws in how attributes feed into rendering logic are a recurring vulnerability class in page builder plugins. The scope change (S:C in CVSS 3.1) reflects that the injected script executes in a different security principal's browser context than the one who planted it.
RemediationAI
No vendor-released patched version has been identified at time of analysis from the available references. Site administrators should check the WordPress plugin repository and the WPScan advisory at https://wpscan.com/vulnerability/519a69d5-ab6f-449a-ab78-78b68598d37f/ for an updated release. If a patched version becomes available, upgrade immediately. As a compensating control, disable or remove the Codeless Page Builder plugin until a fix is confirmed - this eliminates the attack surface entirely but removes page-builder functionality. If the plugin cannot be removed, restrict contributor role assignments to fully trusted users only, since untrusted contributors are the direct threat vector. Enabling a Web Application Firewall with WordPress XSS rulesets (e.g., Wordfence, Sucuri) may detect or block common XSS payload patterns but is not a reliable substitute for a code-level fix given the structural nature of the tag-name injection.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today