CVE-2026-15234 — Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute
The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing…
Published: 2026-08-01 · CVSS: 5.4 · CVSS 3.1
The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of any higher-privileged user (such as an administrator) who views the content.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7