Greg – SiteOrigin vulnerabilities

Products

• Page Builder by SiteOrigin 1
• Simple Proxy 1
• SiteOrigin Widgets Bundle 1

Latest Greg – SiteOrigin CVEs

Newest publication first

1. CVE-2026-97256 WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability

   Published 2026-09-30

   High·CVSS 7.2 EPSS 0.29%

   Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.

2. CVE-2024-56026 WordPress Simple Proxy plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-01-02

   High·CVSS 7.1 EPSS 0.35%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg – SiteOrigin Simple Proxy simple-proxy allows Reflected XSS.This issue affects Simple Proxy: from n/a through <= 1.0.

3. CVE-2024-54268 WordPress SiteOrigin Widgets Bundle plugin <= 1.64.0 - Broken Access Control vulnerability

   Published 2024-12-13

   High·CVSS 8.8 EPSS 0.60%

   Missing Authorization vulnerability in Greg - SiteOrigin SiteOrigin Widgets Bundle so-widgets-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteOrigin Widgets Bundle: from n/a through <= 1.64.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.