Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• wpscan.com/…erability/20bbee29-928f-4503-9cef-69f204441c8e İstismar kodu ya da analiz

Kayıt geçmişi

1. 28 Eki 2026 21:10CVSS puanı değişti: – → 6.8
2. 28 Eki 2026 09:00Yayımlandı

İlgili açıklar

• 2,7 CVE-2026-110507Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments
• 4,7 CVE-2026-61575AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles
• 6,1 CVE-2026-61573AVideo-Encoder: reflected cross-site scripting in the login interface
• 6,1 CVE-2026-118652Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
• 9,4 CVE-2026-63190FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
• 6,1 CVE-2026-11854Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products