Executive brief
The Pagelayer plugin for WordPress, a tool used to design and build website pages, contains a security flaw in its Button widget. This vulnerability allows users with basic contributor permissions to embed malicious scripts into website pages. When other visitors or administrators view these pages, the scripts can execute, potentially leading to unauthorized actions or the theft of sensitive session information.
Technical details
The Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to an incomplete event handler blocklist in the 'pagelayer_xss_content' filtering function. Specifically, the Button widget's Custom Attributes field fails to properly sanitize all possible HTML event handlers, allowing bypasses of the existing security filters. An authenticated attacker with Contributor-level permissions or higher can inject arbitrary JavaScript into the database. This script then executes in the browser context of any user who views the modified page, which can be used to hijack sessions or perform actions on behalf of administrators. The issue is addressed in versions following 2.0.8.
Affected products
- Softaculous Page Builder: Pagelayer up to, and including, 2.0.8
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
References
- https://plugins.trac.wordpress.org/browser/pagelayer/trunk/main/functions.php
- https://plugins.trac.wordpress.org/browser/pagelayer/trunk/main/shortcode_functions.php
- https://plugins.trac.wordpress.org/changeset/3479046/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/915c119d-2bae-4ea6-babb-7e8e99054cd0?source=cve