SiteOrigin Page Builder EUVD-2026-111710

Requires an authenticated account with the WordPress contributor role or higher on a site running SiteOrigin Page Builder before 2.38.0, used to save a post whose widget property carries an unsanitized/unescaped payload. The payload only fires when a higher-privileged user (e.g. editor or administrator) opens that specific post in the page builder editor interface (UI:R) - it does not execute for the attacker or against unauthenticated visitors. Limiting factors: the vulnerable plugin and version must be installed, the attacker must already hold a contributor+ account (so sites that disable self-registration or tightly control contributor accounts are less exposed), and successful impact depends on a privileged victim actively opening the malicious post in the editor.

Signals point to a real but moderate, non-urgent issue rather than a high-priority emergency. The CVSS base score is 6.8 (medium). EPSS is very low at 0.17% (6th percentile), indicating little evidence of broad opportunistic exploitation attempts. The CVE is NOT listed in CISA KEV and no public exploit code is identified, so this is not confirmed active exploitation. The vuln.today decision label is 'this_month', consistent with a moderate-severity flaw that should be patched on a normal cycle rather than immediately. One important conflict must be flagged: the supplied CVSS vector states PR:H (high privileges required), but the description says the attacker only needs the contributor role - in WordPress, contributor is a LOW-privilege authenticated role, so PR:H appears overstated and PR:L would better reflect the described prerequisite; verify with the vendor/WPScan. The vector also requires UI:R (a higher-privileged victim must open the post in the editor), which further limits exploitation. Net assessment: a legitimate stored-XSS privilege-escalation path (contributor → admin session) that warrants patching, but low EPSS, no KEV, no PoC, and the victim-interaction requirement keep real-world risk modest.

A contributor-level user crafts a post with the SiteOrigin Page Builder and places a malicious JavaScript payload in a widget property that the plugin fails to sanitize on storage or escape on output. When an editor or administrator later opens that post in the page builder editor interface, the stored script executes in their authenticated browser session, potentially leading to admin account or session takeover. No public exploit code is identified, and exploitation requires the higher-privileged victim to open the affected post (UI:R).