CVE-2026-3297

MediumCVSS 6.4

Published: 13/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

The Page Builder: Pagelayer WordPress plugin up to version 2.0.9 has a Stored XSS vulnerability via the Anchor block due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts.

Risk Assessment

Attackers can inject malicious scripts that execute on every visit to the affected page, potentially leading to data theft or account takeover.

Recommendation

Update the Pagelayer plugin to a version above 2.0.9. Restrict user permissions to the minimum necessary.

Other vulnerabilities in Page Builder: Pagelayer

CVE-2026-2509Medium
The Page Builder: Pagelayer plugin for WordPress up to version 2.0.8 contains a Stored XSS vulnerability via the Custom Attributes field in the Button widget. The XSS filtering function does not block all event handlers, allowing attackers with contributor-level access or higher to inject scripts.

Original NVD description (English source)

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor block in versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS