CVE-2026-13295 is a stored cross-site scripting vulnerability in the Page Builder by SiteOrigin WordPress plugin. It arises from improper neutralization of input during web page generation (CWE-79). Authenticated attackers with Contributor-level permissions can exploit insufficient sanitization of the panels_data parameter, which is stored as post meta and rendered without proper escaping. The nonce and edit_post capability checks do not prevent Contributors from saving malicious content in their own posts. This allows arbitrary script injection that executes in the context of users viewing the affected pages.

An attacker with Contributor-level access can inject persistent malicious scripts into pages built with the plugin. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability impacts confidentiality and integrity (partial), but does not affect availability. The CVSS 3.1 score is 6.4 (medium severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level user permissions or avoid using the vulnerable plugin versions. Monitor for updates from SiteOrigin and apply official patches once released. No vendor advisory or patch links are currently provided.