High · 7.2 CVE-2026-97256 EUVD-2026-90215GHSA-6p5w-gc4f-g298

WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability

Published Sep 30, 2026 · Updated Sep 30, 2026 · Assigned by Patchstack

Vendor: Greg – SiteOrigin Product: Page Builder by SiteOrigin

Description

Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.

Affected products

Vendor	Product	Affected	Fixed
Greg – SiteOrigin	Page Builder by SiteOrigin	≤ 2.36.0	—

References

https://patchstack.com/database/wordpress/plugin/siteorigin-panels/vulnerability/wordpress-page-builder-by-siteorigin-plugin-2-36-0-php-object-injection-vulnerability?_s_id=cve vdb-entry