GCVE - cpe:2.3:a:siteorigin:page_builder:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:siteorigin:page_builder:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Siteorigin (`123fd401-8065-5cdf-9b32-a8be05902091`)
Product	Page Builder (`dae0592b-40cd-50ee-b3a6-46a060d56cb8`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-1459`	vulnerable	2026-06-08 07:08:37.013769	Page Builder by SiteOrigin <= 2.31.4 - Authenticated (Contributor+) Stored Cross-Site Scripting MEDIUM (6.4) The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Embedded Video(PB) widget in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2025-03-01T06:39:28.906Z Updated: 2026-04-08T17:28:56.343Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/e14c12ef-0774-4459-9a2c-9a4b633a0efe?source=cve https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3247428%40siteorigin-panels&new=3247428%40siteorigin-panels&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-4361`	vulnerable	2026-06-08 06:50:17.581466	Page Builder by SiteOrigin <= 2.29.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode MEDIUM (6.4) The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteorigin_widget' shortcode in all versions up to, and including, 2.29.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2024-05-21T11:02:29.008Z Updated: 2026-04-08T17:14:07.895Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/a97f72f6-86f7-45dc-908a-292ba735071d?source=cve https://plugins.trac.wordpress.org/browser/siteorigin-panels/trunk/inc/widget-shortcode.php#L40 https://plugins.trac.wordpress.org/changeset/3086025/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-2202`	vulnerable	2026-06-08 06:33:30.573000	Page Builder by SiteOrigin <= 2.29.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Legacy Image Widget MEDIUM (6.4) The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the legacy Image widget in all versions up to, and including, 2.29.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2024-03-23T02:32:55.338Z Updated: 2026-04-08T16:52:43.190Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/52116a6f-506f-4eeb-9bcc-19900ef38101?source=cve https://plugins.trac.wordpress.org/browser/siteorigin-panels/trunk/widgets/widgets.php#L911 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3053935%40siteorigin-panels&new=3053935%40siteorigin-panels&sfp_email=&sfph_mail=#file31	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-12240`	vulnerable	2026-06-08 06:23:51.506625	Page Builder by SiteOrigin <= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter MEDIUM (6.4) The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the row label parameter in all versions up to, and including, 2.31.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2025-01-14T11:08:35.888Z Updated: 2026-04-08T17:14:45.190Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/abe8c6b0-b16b-4391-88b4-dca507c973fc?source=cve https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.31.0/tpl/metabox-panels.php#L17	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-13643`	vulnerable	2026-06-08 05:18:00.948803	Details available HIGH (8.8) An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser. Published: 2020-05-28T03:11:48.000Z Updated: 2024-08-04T12:25:16.534Z Open on db.gcve.eu Reference links https://www.wordfence.com/blog/2020/05/vulnerabilities-patched-in-page-builder-by-siteorigin-affects-over-1-million-sites/ https://wordpress.org/plugins/siteorigin-panels/#developers	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-13642`	vulnerable	2026-06-08 05:18:00.948346	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.