Codeless Page Builder tag attributes let Contributors store JavaScript
Codeless Page Builder through 1.1.4 uses an unsanitized shortcode attribute as an HTML tag name while rendering content. A Contributor-or-higher user can supply a crafted tag value that breaks the intended markup and injects HTML and JavaScript, which executes for an Administrator or other user who views the affected content. The record does not disclose the shortcode name, attribute name, renderer function or exact payload encoding.
- Component
- Codeless Page Builder
- Plugin slug
codeless-page-builder- Affected
- <= 1.1.4
- Safe version
- See mitigation notes
- Published
- Aug 01, 2026
- Weakness
- Not assigned
This CVE was published Aug 01, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
No fixed public release is identified for Codeless Page Builder through 1.1.4. Restrict shortcode editing by untrusted users or deactivate the affected builder when warranted until a corrected release is available. Review content authored by Contributors for malformed tag attributes and invalidate privileged sessions if affected content was viewed.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of any higher-privileged user (such as an administrator) who views the content.