Extension WordPress
Vulnérabilités Page Builder by SiteOrigin
Cette page rassemble les failles publiées pour Page Builder by SiteOrigin, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Page Builder by SiteOrigin
9 fiches
Page Builder by SiteOrigin <= 2.34.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Parameter in all versions up to, and including, 2.34.3 due to insufficient input sanitization and output escaping. This makes it possible for…
*-2.34.3
2.34.4
26/06/2026
Page Builder by SiteOrigin <= 2.33.5 – Authenticated (Contributor+) Local File Inclusion
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.5 via the locate_template() function. This makes it possible for authenticated attackers, with Contributor-level access and above,…
*-2.33.5
2.34.0
02/03/2026
Page Builder by SiteOrigin <= 2.31.4 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Embedded Video(PB) widget in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it…
*-2.31.4
2.31.5
28/02/2025
Page Builder by SiteOrigin <= 2.31.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the row label parameter in all versions up to, and including, 2.31.0 due to insufficient input sanitization and output escaping. This makes it…
*-2.31.0
2.31.1
13/01/2025
Page Builder by SiteOrigin <= 2.29.15 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteorigin_widget' shortcode in all versions up to, and including, 2.29.15 due to insufficient input sanitization and output escaping on user supplied…
*-2.29.15
2.29.16
20/05/2024
Page Builder by SiteOrigin <= 2.29.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Legacy Image Widget
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the legacy Image widget in all versions up to, and including, 2.29.6 due to insufficient input sanitization and output escaping. This makes it…
*-2.29.6
2.29.7
22/03/2024
Page Builder by SiteOrigin <= 2.10.15 – Cross-Site Request Forgery to Reflected Cross-Site Scripting
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST…
[*, 2.10.16)
2.10.16
11/05/2020
Page Builder by SiteOrigin <= 2.10.15 – Cross-Site Request Forgery to Reflected Cross-Site Scripting
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The panels_data $_POST variable…
*-2.10.15
2.10.16
05/05/2020
Page Builder by SiteOrigin < 2.0.5 – Reflected Cross-Site Scripting
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘siteorigin_panels_render_form()’ parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for…
[*, 2.0.5)
2.0.5
01/12/2015
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.