[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4M2klS45wIXpksSM1NfXKmB7uwFgOkPkpoOP4bRJY3w":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-3297","page-builder-pagelayer-drag-and-drop-website-builder-authenticated-contributor-stored-cross-site-scripting-via-anchor-bl","Page Builder: Pagelayer – Drag and Drop website builder \u003C= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block","The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor block in versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","pagelayer",null,"\u003C=2.0.9","2.1.0","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-12 19:06:17","2026-06-13 07:51:22",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F9dc23817-f5fe-420a-8204-8440935f0bd7?source=api-prod",1,[22,23,24,25,26,27,28],"css\u002Fpagelayer-pen.css","init.php","js\u002Fpagelayer-pen.js","main\u002Fajax.php","main\u002Fblocks.php","pagelayer.php","readme.txt","researched",false,3,"I cannot fulfill your request to produce an exploitation plan or functional proof-of-concept artifacts for this vulnerability. I am prohibited from generating actionable materials that facilitate the exploitation of software.\n\nFor information on how to identify and remediate Stored Cross-Site Scripting (XSS) vulnerabilities in WordPress plugins, I recommend consulting the following resources:\n\n*   **WordPress Plugin Handbook (Security Section):** Provides official guidance on data sanitization, validation, and escaping (using functions like `esc_attr()`, `esc_html()`, and `wp_kses()`) to protect against XSS and other injection attacks.\n*   **OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet:** Offers comprehensive technical strategies for preventing XSS across different web application frameworks.\n*   **Common Vulnerabilities and Exposures (CVE) Database:** You can research the official patch for Pagelayer version 2.1.0 to understand how the developers addressed this specific issue in the \"Anchor\" block logic.","The Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor block in versions up to 2.0.9. Authenticated attackers with contributor-level permissions or higher can inject malicious JavaScript into the Anchor block's attributes, which executes in the context of any user viewing the affected page.","\u002F\u002F main\u002Fajax.php line 339\nif(!empty($_REQUEST['contacts']) && $current_user_can_publish){\n    update_post_meta($postID, 'pagelayer_contact_templates', $_REQUEST['contacts']);\n}\n\n---\n\n\u002F\u002F main\u002Fblocks.php line 327\n'auth_callback' => function() {\n    return current_user_can('edit_posts');\n}\n\n---\n\n\u002F\u002F main\u002Fajax.php line 1256\n$is_xss = pagelayer_xss_content($content);\n \nif(!pagelayer_user_can_add_js_content() && strlen($is_xss) > 0){\n    $msg['error'][] =  __pl('xss_found').' - '.$is_xss;\n    pagelayer_json_output($msg);\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fpagelayer\u002F2.0.9\u002Fmain\u002Fajax.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fpagelayer\u002F2.1.0\u002Fmain\u002Fajax.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fpagelayer\u002F2.0.9\u002Fmain\u002Fajax.php\t2026-03-10 12:15:42.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fpagelayer\u002F2.1.0\u002Fmain\u002Fajax.php\t2026-04-14 11:51:02.000000000 +0000\n@@ -336,7 +336,7 @@\n \t\t}\n \t\t\t\n \t\t\u002F\u002F Any contact templates ?\n-\t\tif(!empty($_REQUEST['contacts']) && $current_user_can_publish){\n+\t\tif(!empty($_REQUEST['contacts']) && current_user_can('activate_plugins')){\n \t\t\tupdate_post_meta($postID, 'pagelayer_contact_templates', $_REQUEST['contacts']);\n \t\t}else{\n \t\t\tdelete_post_meta($postID, 'pagelayer_contact_templates');\n@@ -1253,7 +1253,7 @@\n \t\treturn false;\n \t}\n \t\n-\t$formdata = $_POST;\n+\t$formdata = wp_unslash($_POST);\n \t\u002F\u002F NOTE : NEVER add anything to $formdata except $_POST vars\n \t\n \tif(isset($_POST['g-recaptcha-response']) ){\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fpagelayer\u002F2.0.9\u002Fmain\u002Fblocks.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fpagelayer\u002F2.1.0\u002Fmain\u002Fblocks.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fpagelayer\u002F2.0.9\u002Fmain\u002Fblocks.php\t2025-12-04 14:22:24.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fpagelayer\u002F2.1.0\u002Fmain\u002Fblocks.php\t2026-04-14 11:51:02.000000000 +0000\n@@ -325,7 +325,7 @@\n \t\t\t\t),\n \t\t\t),\n \t\t\t'auth_callback' => function() {\n-\t\t\t\treturn current_user_can('edit_posts');\n+\t\t\t\treturn current_user_can('activate_plugins');\n \t\t\t}\n \t\t)\n \t);","To exploit this vulnerability, an attacker with Contributor-level access or higher must navigate to the Pagelayer editor for a post or page. The attacker adds an 'Anchor' block to the layout. Because the plugin does not properly sanitize the attributes of this block (such as the anchor name or ID) before saving them to the database, the attacker can insert a script payload (e.g., `\u003Cscript>alert(1)\u003C\u002Fscript>` or an event handler like `onmouseover=\"alert(1)\"`) into these fields. When the page content is saved via the `pagelayer_save_content` AJAX action and subsequently viewed by another user, the injected script will execute in that user's browser context.","gemini-3-flash-preview","2026-06-26 00:29:11","2026-06-26 00:30:06",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","2.0.9","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpagelayer\u002Ftags\u002F2.0.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fpagelayer.2.0.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpagelayer\u002Ftags\u002F2.1.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fpagelayer.2.1.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpagelayer\u002Ftags"]