Codeless Page Builder <= 1.1.4 – Contributor+ Stored XSS via Shortcode Attribute | CVE 2026-15234

Description

The plugin does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of any higher-privileged user (such as an administrator) who views the content.

Proof of Concept

Prerequisite: Codeless Page Builder <= 1.1.4 and its required Kirki Framework are both active (the plugin does not register its shortcodes without Kirki; standalone, Kirki is the free "kirki" plugin on wordpress.org). The attacker holds the Contributor role.

1. As a Contributor, create a new post with the following content and save it as Pending Review:

   [cl_service title_typography="img src=x onerror=alert(document.domain) x="]

2. As an Administrator, go to Posts > All Posts, locate the pending post, and click Preview.

3. The attribute value is used verbatim as the service title's HTML tag name, so the injected img element renders with a broken src and fires its onerror handler, executing alert(document.domain) in the Administrator's session.