CVE-2026-13295 is a stored cross-site scripting vulnerability in the Page Builder by SiteOrigin WordPress plugin affecting all versions up to and including 2.34.3. The issue stems from inadequate sanitization and escaping of the panels_data parameter, which is stored as post meta. Contributor-level users can bypass nonce and edit_post capability checks for their own posts, enabling them to inject arbitrary web scripts via the WP_Widget_Custom_HTML content. These scripts execute whenever a user accesses the affected page, potentially compromising user sessions or performing other malicious actions. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (medium severity). No official patch or remediation has been documented in the provided data.

An authenticated attacker with Contributor-level access or higher can inject persistent malicious scripts into pages built with the plugin. These scripts execute in the context of any user viewing the compromised page, potentially leading to session hijacking, unauthorized actions, or data theft. The vulnerability affects the confidentiality and integrity of user interactions but does not impact availability. Since the vulnerability requires authenticated access, the attack surface is limited to users with at least Contributor privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level user capabilities where possible and monitor for suspicious activity related to page content. Avoid granting Contributor or higher privileges to untrusted users. Review and sanitize panels_data content manually if feasible. No official patch or temporary fix is documented in the provided information.