Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.4
WordPress Pagelayer Plugin Allows Hackers to Inject Malicious Code
CVE-2026-2509
Summary
A security flaw in the Pagelayer plugin for WordPress allows attackers with high-level access to inject malicious code into pages. This can happen when a user visits the affected page. To fix this issue, update the Pagelayer plugin to the latest version, which is 2.0.9 and above.
Original title
The Page Builder: Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget's Custom Attributes field in all versions up to, and including, 2.0.8. This is du...
Original description
The Page Builder: Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget's Custom Attributes field in all versions up to, and including, 2.0.8. This is due to an incomplete event handler blocklist in the 'pagelayer_xss_content' XSS filtering function, which blocks common, but not all, event handlers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
nvd CVSS3.1
6.4
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
- https://plugins.trac.wordpress.org/browser/pagelayer/trunk/main/functions.php#L1...
- https://plugins.trac.wordpress.org/browser/pagelayer/trunk/main/shortcode_functi...
- https://plugins.trac.wordpress.org/changeset/3479046/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/915c119d-2bae-4ea6-bab...
Published: 8 Apr 2026 · Updated: 9 Apr 2026 · First seen: 8 Apr 2026