WordPress security changelog
UNKNOWN CVE-2026-15234 Received

Codeless Page Builder tag attributes let Contributors store JavaScript

Codeless Page Builder through 1.1.4 uses an unsanitized shortcode attribute as an HTML tag name while rendering content. A Contributor-or-higher user can supply a crafted tag value that breaks the intended markup and injects HTML and JavaScript, which executes for an Administrator or other user who views the affected content. The record does not disclose the shortcode name, attribute name, renderer function or exact payload encoding.

CVE / CNA score Pending The CVE record has not published a CNA CVSS assessment.
NVD score Pending NVD has not published its own CVSS assessment.
Component
Codeless Page Builder
Plugin slug
codeless-page-builder
Affected
<= 1.1.4
Safe version
See mitigation notes
Published
Aug 01, 2026
Weakness
Not assigned

This CVE was published Aug 01, 2026 and is one of 1 known issue for this plugin.

Update, patch or deactivate.

No fixed public release is identified for Codeless Page Builder through 1.1.4. Restrict shortcode editing by untrusted users or deactivate the affected builder when warranted until a corrected release is available. Review content authored by Contributors for malformed tag attributes and invalidate privileged sessions if affected content was viewed.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Technical description

The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of any higher-privileged user (such as an administrator) who views the content.

Primary and upstream sources