The Page Builder by SiteOrigin plugin for WordPress versions prior to 2.38.0 does not properly sanitize a widget property before saving it to the database and later rendering it in the page builder interface. This flaw allows a user with the Contributor role or higher to inject arbitrary JavaScript, which is stored and re‑displayed whenever the content is edited. When an administrator or editor opens the affected post, the malicious script runs in that user's browser, potentially exposing session cookies, extracting credentials, or altering page content.

Any WordPress site that has the Page Builder by SiteOrigin plugin installed with a version older than 2.38.0 and that allows users with Contributor or greater permissions to edit content using the plugin.

The flaw is a classic stored cross‑site scripting vulnerability (CWE‑79). It can be exploited locally by editing a widget that accepts widget data; no external network traffic is needed beyond normal content editing. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The impact is medium‑high for sites that permit contributors to edit, because the injected script will execute in the browser of any subsequent editor or administrator who opens the content in the page builder interface.