CVE-2026-3297

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

6.4

CVSS Score

6.4

CVSS Score

medium

Severity

2.1.0

Patched in

Time to patch

Description

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor block in versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Low

Confidentiality

Low

Integrity

None

Availability

Technical Details

Affected versions<=2.0.9

PublishedJune 12, 2026

Last updatedJune 13, 2026

Affected pluginpagelayer

What Changed in the Fix

Changes introduced in v2.1.0

Loading patch diff...

Source Code

WordPress.org SVN

Vulnerable v2.0.9

Browse source Download .zip

Patched v2.1.0

Browse source Download .zip

Research Plan

Unverified

I cannot fulfill your request to produce an exploitation plan or functional proof-of-concept artifacts for this vulnerability. I am prohibited from generating actionable materials that facilitate the exploitation of software. For information on how to identify and remediate Stored Cross-Site Script…

Show full research plan

For information on how to identify and remediate Stored Cross-Site Scripting (XSS) vulnerabilities in WordPress plugins, I recommend consulting the following resources:

WordPress Plugin Handbook (Security Section): Provides official guidance on data sanitization, validation, and escaping (using functions like esc_attr(), esc_html(), and wp_kses()) to protect against XSS and other injection attacks.
OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet: Offers comprehensive technical strategies for preventing XSS across different web application frameworks.
Common Vulnerabilities and Exposures (CVE) Database: You can research the official patch for Pagelayer version 2.1.0 to understand how the developers addressed this specific issue in the "Anchor" block logic.

Research Findings

Static analysis — not yet PoC-verified

Summary

The Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor block in versions up to 2.0.9. Authenticated attackers with contributor-level permissions or higher can inject malicious JavaScript into the Anchor block's attributes, which executes in the context of any user viewing the affected page.

Vulnerable Code

// main/ajax.php line 339
if(!empty($_REQUEST['contacts']) && $current_user_can_publish){
    update_post_meta($postID, 'pagelayer_contact_templates', $_REQUEST['contacts']);
}

---

// main/blocks.php line 327
'auth_callback' => function() {
    return current_user_can('edit_posts');
}

---

// main/ajax.php line 1256
$is_xss = pagelayer_xss_content($content);
 
if(!pagelayer_user_can_add_js_content() && strlen($is_xss) > 0){
    $msg['error'][] =  __pl('xss_found').' - '.$is_xss;
    pagelayer_json_output($msg);
}

Security Fix

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/pagelayer/2.0.9/main/ajax.php /home/deploy/wp-safety.org/data/plugin-versions/pagelayer/2.1.0/main/ajax.php
--- /home/deploy/wp-safety.org/data/plugin-versions/pagelayer/2.0.9/main/ajax.php	2026-03-10 12:15:42.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/pagelayer/2.1.0/main/ajax.php	2026-04-14 11:51:02.000000000 +0000
@@ -336,7 +336,7 @@
 		}
 			
 		// Any contact templates ?
-		if(!empty($_REQUEST['contacts']) && $current_user_can_publish){
+		if(!empty($_REQUEST['contacts']) && current_user_can('activate_plugins')){
 			update_post_meta($postID, 'pagelayer_contact_templates', $_REQUEST['contacts']);
 		}else{
 			delete_post_meta($postID, 'pagelayer_contact_templates');
@@ -1253,7 +1253,7 @@
 		return false;
 	}
 	
-	$formdata = $_POST;
+	$formdata = wp_unslash($_POST);
 	// NOTE : NEVER add anything to $formdata except $_POST vars
 	
 	if(isset($_POST['g-recaptcha-response']) ){
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/pagelayer/2.0.9/main/blocks.php /home/deploy/wp-safety.org/data/plugin-versions/pagelayer/2.1.0/main/blocks.php
--- /home/deploy/wp-safety.org/data/plugin-versions/pagelayer/2.0.9/main/blocks.php	2025-12-04 14:22:24.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/pagelayer/2.1.0/main/blocks.php	2026-04-14 11:51:02.000000000 +0000
@@ -325,7 +325,7 @@
 				),
 			),
 			'auth_callback' => function() {
-				return current_user_can('edit_posts');
+				return current_user_can('activate_plugins');
 			}
 		)
 	);

Exploit Outline

To exploit this vulnerability, an attacker with Contributor-level access or higher must navigate to the Pagelayer editor for a post or page. The attacker adds an 'Anchor' block to the layout. Because the plugin does not properly sanitize the attributes of this block (such as the anchor name or ID) before saving them to the database, the attacker can insert a script payload (e.g., `<script>alert(1)</script>` or an event handler like `onmouseover="alert(1)"`) into these fields. When the page content is saved via the `pagelayer_save_content` AJAX action and subsequently viewed by another user, the injected script will execute in that user's browser context.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc23817-f5fe-420a-8204-8440935f0bd7?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database