PB
Product
Page Builder: Pagelayer – Drag and Drop website builder
14
CVEs
0
On KEV
6.4
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 14Low 0
Watch
Add Page Builder: Pagelayer – Drag and Drop website builder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-3297 | 6.4 | Jun 13 | Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block Affected: through 2.0.9 |
| CVE-2026-2509 | 6.4 | Apr 8 | Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes Affected: through 2.0.8 |
| CVE-2024-13427 | 6.4 | May 24 | Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link Affected: through 2.0.0 |
| CVE-2024-2504 | 5.4 | Apr 9 | Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes Affected: through 1.8.4 |
| CVE-2024-2127 | 5.4 | Mar 7 | Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes Affected: through 1.8.3 |
| CVE-2024-1590 | 5.4 | Feb 23 | Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Affected: through 1.8.2 |
| CVE-2023-6738 | 5.4 | Jan 4 | PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields Affected: through 1.7.8 |
| CVE-2026-2442 | 5.3 | Mar 28 | Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email' Affected: through 2.0.7 |
| CVE-2025-4223 | 4.7 | May 24 | Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter Affected: through 2.0.0 |
| CVE-2026-2470 | 4.3 | Jun 13 | Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts' Affected: through 2.0.9 |
| CVE-2025-12366 | 4.3 | Nov 13 | Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference Affected: through 2.0.5 |
| CVE-2025-2104 | 4.3 | Mar 13 | Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication Affected: through 1.9.8 |
| CVE-2024-13430 | 4.3 | Mar 12 | Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode Affected: through 1.9.8 |
| CVE-2025-1926 | 4.3 | Mar 10 | Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification Affected: through 1.9.8 |
Showing 14