Medium 4.3
2026-04-08< 2.0.9
CVE-2026-39469
Page Builder: Pagelayer – Drag and Drop website builder
Minimum safe version
2.0.9
Update to 2.0.9 or later to address 33 fixable vulnerabilities
Latest available2.1.0 ✓
N/A
2026-04-07< 2.0.9
Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
N/A
2026-03-27< 2.0.8
Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'
Medium 4.3
2025-11-13< 2.0.6
CVE-2025-12366
Medium 4.7
2025-05-24< 2.0.1
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter
Medium 6.4
2025-05-24< 2.0.1
CVE-2024-13427
Medium 4.8
2025-05-15< 1.9.0
Page Builder: Pagelayer <= 1.8.9 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium 4.8
2025-05-15< 1.8.8
Page Builder: Pagelayer <= 1.8.7 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium 4.3
2025-03-13< 2.0.0
Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication
Medium 4.3
2025-03-12< 1.9.9
CVE-2024-13430
Medium 4.3
2025-03-10< 1.9.9
Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification
Medium 6.5
2025-01-24< 1.9.5
CVE-2025-24573
Medium 4.8
2024-09-17< 1.8.8
CVE-2024-43972
Medium 6.5
2024-06-09< 1.8.2
CVE-2024-30465
Medium 5.4
2024-04-09< 1.8.5
CVE-2024-2504
Medium 5.4
2024-03-07< 1.8.4
CVE-2024-2127
Medium 4.8
2024-02-27< 1.8.1
CVE-2023-7115
Medium 5.4
2024-02-23< 1.8.3
CVE-2024-1590
Medium 4.8
2024-01-31< 1.8.0
Pagelayer <= 1.7.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via Header/Footer code
N/A
< 1.7.7
PageLayer < 1.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 5.4
2024-01-04< 1.7.9
CVE-2023-6738
N/A
2023-12-01< 1.7.8
PageLayer <= 1.7.7 - Cross-Site Request Forgery via pagelayer_load_plugin
Medium 4.3
2024-12-09< 1.7.8
CVE-2023-49196
Medium 5.4
2023-10-17< 1.7.8
WordPress PageLayer Plugin < 1.7.8 is vulnerable to Cross Site Scripting (XSS)
Medium 6.1
2023-10-17< 1.7.7
WordPress PageLayer Plugin < 1.7.7 is vulnerable to Cross Site Scripting (XSS)
N/A
2023-09-14< 1.7.7
WordPress PageLayer Plugin < 1.7.7 is vulnerable to Cross Site Scripting (XSS)
N/A
2023-09-13< 1.7.7
PageLayer <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
N/A
< 1.3.5
Pagelayer < 1.3.5 - Multiple Reflected Cross-Site Scripting (XSS)
N/A
2020-12-10< 1.3.5
WordPress PageLayer plugin <= 1.3.4 - Reflected Cross-Site Scripting (XSS) vulnerability
High 7.4
2021-01-01< 1.1.2
CVE-2020-35947
High 8.8
2021-01-01< 1.1.2
CVE-2020-35944
Medium 6.1
2021-06-07< 1.3.5
CVE-2020-36384
Medium 6.1
2021-06-07< 1.3.5
CVE-2020-36383