EN ES
Start free
Menu

Page Builder: Pagelayer – Drag and Drop website builder: known security problems

30 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 30 known security problems on this page. Each one has a fixed version. Updating to version 2.1.0 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone with a contributor account on your site could use it to harm your site (up to and including 2.0.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.9
Fixed in
2.1.0
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 2.1.0 or newer.
Official ID
CVE-2026-2470
Report title
Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.0.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.9
Fixed in
2.1.0
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 2.1.0 or newer.
Official ID
CVE-2026-3297
Report title
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.0.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.8
Fixed in
2.0.9
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 2.0.9 or newer.
Official ID
CVE-2026-2509
Report title
Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
First reported
Sources
This week

A stranger could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.7
Fixed in
2.0.8
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 2.0.8 or newer.
Official ID
CVE-2026-2442
Report title
Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 2.0.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.8
Fixed in
2.0.9
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 2.0.9 or newer.
Official ID
CVE-2026-39469
Report title
PageLayer <= 2.0.8 - Authenticated (Contributor+) Information Exposure
First reported
Sources
This week

Someone with an author account on your site could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.5
Fixed in
2.0.6
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 2.0.6 or newer.
Official ID
CVE-2025-12366
Report title
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.0
Fixed in
2.0.1
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 2.0.1 or newer.
Official ID
CVE-2025-4223
Report title
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.0.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.0
Fixed in
2.0.1
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 2.0.1 or newer.
Official ID
CVE-2024-13427
Report title
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link
First reported
Sources
This week

Someone with a contributor account on your site could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.9.8
Fixed in
2.0.0
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 2.0.0 or newer.
Official ID
CVE-2025-2104
Report title
Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 1.9.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.9.8
Fixed in
1.9.9
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.9.9 or newer.
Official ID
CVE-2024-13430
Report title
Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 1.9.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.9.8
Fixed in
1.9.9
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.9.9 or newer.
Official ID
CVE-2025-1926
Report title
Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.9.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.9.4
Fixed in
1.9.5
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.9.5 or newer.
Official ID
CVE-2025-24573
Report title
PageLayer <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.8.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.9
Fixed in
1.9.0
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.9.0 or newer.
Official ID
CVE-2024-8618
Report title
Page Builder: Pagelayer <= 1.8.9 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins (up to and including 1.8.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.7
Fixed in
1.8.8
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.8.8 or newer.
Official ID
CVE-2024-43972
Report title
PageLayer <= 1.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.8.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.7
Fixed in
1.8.8
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.8.8 or newer.
Official ID
CVE-2024-8426
Report title
Page Builder: Pagelayer <= 1.8.7 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.1
Fixed in
1.8.2
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.8.2 or newer.
Official ID
CVE-2024-30465
Report title
PageLayer <= 1.8.1 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.8.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.4
Fixed in
1.8.5
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.8.5 or newer.
Official ID
CVE-2024-2504
Report title
Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.8.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.3
Fixed in
1.8.4
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.8.4 or newer.
Official ID
CVE-2024-2127
Report title
Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.8.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.2
Fixed in
1.8.3
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.8.3 or newer.
Official ID
CVE-2024-1590
Report title
Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins (before 1.8.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.8.0
Fixed in
1.8.0
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.8.0 or newer.
Official ID
CVE-2023-5124
Report title
Pagelayer <= 1.7.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via Header/Footer code
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.8
Fixed in
1.7.9
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.7.9 or newer.
Official ID
CVE-2023-6738
Report title
PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.7.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.9
Fixed in
1.8.1
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.8.1 or newer.
Official ID
CVE-2023-7115
Report title
Page Builder: Pagelayer <= 1.7.9 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 1.7.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.7
Fixed in
1.7.8
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.7.8 or newer.
Official ID
CVE-2023-49196
Report title
PageLayer <= 1.7.7 - Cross-Site Request Forgery via pagelayer_load_plugin
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.7.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.6
Fixed in
1.7.7
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.7.7 or newer.
Official ID
CVE-2023-4687
Report title
Page Builder: Pagelayer – Drag and Drop website builder <= 1.7.6 - Missing Authorization to Stored Cross-Site Scripting
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.7
Fixed in
1.7.8
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.7.8 or newer.
Official ID
CVE-2023-5087
Report title
Page Builder: Pagelayer <= 1.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via Header/Footer
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (before 1.7.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.7.7
Fixed in
1.7.7
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.7.7 or newer.
Report title
PageLayer <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.3.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.3.5
Fixed in
1.3.5
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.3.5 or newer.
Official ID
CVE-2020-36383
Report title
Page Builder: Pagelayer – Drag and Drop website builder < 1.3.5 - Reflected Cross-Site Scripting via font-size
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.3.5) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.3.5
Fixed in
1.3.5
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.3.5 or newer.
Official ID
CVE-2020-36384
Report title
Page Builder: Pagelayer – Drag and Drop website builder < 1.3.5 - Reflected Cross-Site Scripting via Color Settings
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.1.2
Fixed in
1.1.2
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.1.2 or newer.
Official ID
CVE-2020-35944
Report title
Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Cross-Site Request Forgery to Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.1.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.1.2
Fixed in
1.1.2
What to do
If your site has an affected version, update Page Builder: Pagelayer – Drag and Drop website builder to version 1.1.2 or newer.
Official ID
CVE-2020-35947
Report title
Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Missing Authorization to Cross-Site Scripting
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)