gpriday vulnerabilities

CVEs per yearBy the year they were published

1. 20249
2. 20253
3. 20267

Newest CVEs

• CVE-2026-107764

  SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink

  gpriday · SiteOrigin CSS

  High7.2
• CVE-2026-111122

  SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector

  gpriday · SiteOrigin CSS

  High7.2
• CVE-2026-97348

  SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)

  gpriday · SiteOrigin Widgets Bundle

  Medium6.5
• CVE-2026-92174

  SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter

  gpriday · SiteOrigin Widgets Bundle

  High7.5
• CVE-2026-13295

  Page Builder by SiteOrigin <= 2.34.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter

  gpriday · Page Builder by SiteOrigin

  Medium6.4
• CVE-2026-2448

  Page Builder by SiteOrigin <= 2.33.5 - Authenticated (Contributor+) Local File Inclusion

  gpriday · Page Builder by SiteOrigin

  High8.8
• CVE-2026-2127

  SiteOrigin Widgets Bundle <= 1.70.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution

  gpriday · SiteOrigin Widgets Bundle

  Medium5.4
• CVE-2025-5585

  SiteOrigin Widgets Bundle <= 1.68.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-url` DOM Element Attribute

  gpriday · SiteOrigin Widgets Bundle

  Medium6.4
• CVE-2025-1459

  Page Builder by SiteOrigin <= 2.31.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

  gpriday · Page Builder by SiteOrigin

  Medium6.4
• CVE-2024-12240

  Page Builder by SiteOrigin <= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter

  gpriday · Page Builder by SiteOrigin

  Medium6.4