CVE-2025-1459: 
WordPress vulnerability analysis and mitigation

The Page Builder by SiteOrigin plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-1459) discovered in versions up to and including 2.31.4. The vulnerability was disclosed on March 1, 2025, and affects the Embedded Video(PB) widget component (NVD CVE).

The vulnerability is classified as a Stored Cross-Site Scripting (CWE-79) issue due to insufficient input sanitization and output escaping in the Embedded Video(PB) widget. The vulnerability has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (Wordfence Intel).

When exploited, this vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever any user accesses the compromised page (NVD CVE).

The vulnerability requires an authenticated user with at least Contributor-level privileges to exploit. The attack complexity is considered low, requiring network access and no user interaction for successful exploitation (Wordfence Intel).

A patch has been released and is available through the WordPress plugin repository. Users are advised to update their Page Builder by SiteOrigin plugin to a version newer than 2.31.4 (WordPress Changeset).