CVE-2026-2509
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The Page Builder: Pagelayer plugin for WordPress up to version 2.0.8 contains a Stored XSS vulnerability via the Custom Attributes field in the Button widget. The XSS filtering function does not block all event handlers, allowing attackers with contributor-level access or higher to inject scripts.
Risk Assessment
The risk involves potential arbitrary script execution on pages, which could lead to user account takeover or malware distribution.
Recommendation
Update the Pagelayer plugin to a version newer than 2.0.8 that fixes this vulnerability.
Original NVD description (English source)
The Page Builder: Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget's Custom Attributes field in all versions up to, and including, 2.0.8. This is due to an incomplete event handler blocklist in the 'pagelayer_xss_content' XSS filtering function, which blocks common, but not all, event handlers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.