Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

29 results

Jun 13, 2026Page Builder: Pagelayer – Drag and Drop website builder: Stored Cross-Site ScriptingCVE-2026-3297 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor block in versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 13, 2026Page Builder: Pagelayer – Drag and Drop website builder: Incorrect AuthorizationCVE-2026-2470 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.9. This is due to the pagelayer_save_content AJAX handler allowing users with basic post-edit capability to persist pagelayer_contact_templates metadata on posts they can edit (including pending posts), while the unauthenticated pagelayer_contact_submit endpoint later consumes that metadata by user-controlled post/form identifiers without enforcing a privileged or published-context boundary. This makes it possible for authenticated attackers, with Contributor-level access and above, to configure arbitrary contact-form mail templates that are usable through unauthenticated form submission via the contacts parameter. In typical deployments this template feature is configured via Pagelayer Pro UI; however, the vulnerable backend trust path is still present. This issue may be chained with CVE-2026-2442 to increase exploitability and attacker control over outbound email behavior.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 8, 2026Page Builder: Pagelayer: Stored Cross-Site ScriptingCVE-2026-2509 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder: Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget's Custom Attributes field in all versions up to, and including, 2.0.8. This is due to an incomplete event handler blocklist in the 'pagelayer_xss_content' XSS filtering function, which blocks common, but not all, event handlers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Page Builder: Pagelayer
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Page Builder: Pagelayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026PageLayer: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-39469 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Softaculous PageLayer pagelayer allows Retrieve Embedded Sensitive Data.This issue affects PageLayer: from n/a through <= 2.0.8.
Product
PageLayer
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update PageLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2026Page Builder: Pagelayer – Drag and Drop website builder: Improper Neutralization of CRLF Sequences ('CRLF Injection')CVE-2026-2442 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in all versions up to, and including, 2.0.7. This is due to the contact form handler performing placeholder substitution on attacker-controlled form fields and then passing the resulting values into email headers without removing CR/LF characters. This makes it possible for unauthenticated attackers to inject arbitrary email headers (for example Bcc / Cc) and abuse form email delivery via the 'email' parameter granted they can target a contact form configured to use placeholders in mail template headers.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025Page Builder: Pagelayer – Drag and Drop website builder: Insecure Direct Object ReferenceCVE-2025-12366 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.5 via the pagelayer_replace_page function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to replace media files belonging to other users, including administrators.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 24, 2025Page Builder: Pagelayer – Drag and Drop website builder: Reflected Cross-Site ScriptingCVE-2025-4223 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘login_url’ parameter in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. A valid username/password pair needs to be supplied in order to be successfully exploited and any injected scripts will only execute in the context of that authenticated user.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 23, 2025Page Builder: Pagelayer – Drag and Drop website builder: Stored Cross-Site ScriptingCVE-2024-13427 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 1.9.9 and completely fixed in version 2.0.1.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 2.0.0
Fixed in
1.9.9
What to do
Update Page Builder: Pagelayer – Drag and Drop website builder to 1.9.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 15, 2025Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2024-8618 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Page Builder: Pagelayer
Fixed in
1.9.0
What to do
Update Page Builder: Pagelayer to 1.9.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2024-8426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Page Builder: Pagelayer
Fixed in
1.8.8
What to do
Update Page Builder: Pagelayer to 1.8.8 or newer.
Full record and what to do →NVD record wpscan.com
Mar 13, 2025Page Builder: Pagelayer – Drag and Drop website builder: Unauthorized post publicationCVE-2025-2104 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insufficient validation on the pagelayer_save_content() function in all versions up to, and including, 1.9.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to bypass post moderation and publish posts to the site.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 12, 2025Page Builder: Pagelayer – Drag and Drop website builder: Information ExposureCVE-2024-13430 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.8 via the 'pagelayer_builder_posts_shortcode' function due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private posts that they should not have access to.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2025Page Builder: Pagelayer – Drag and Drop website builder: Cross-Site Request ForgeryCVE-2025-1926 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.8. This is due to missing or incorrect nonce validation on the pagelayer_save_post function. This makes it possible for unauthenticated attackers to modify post contents via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 24, 2025PageLayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24573 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softaculous PageLayer pagelayer allows DOM-Based XSS.This issue affects PageLayer: from n/a through <= 1.9.4.
Product
PageLayer
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update PageLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024PageLayer: Missing AuthorizationCVE-2023-49196 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Pagelayer Team PageLayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PageLayer: from n/a through 1.7.7.
Product
PageLayer
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update PageLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2024PageLayer: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43972 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pagelayer Team PageLayer allows Stored XSS.This issue affects PageLayer: from n/a through 1.8.7.
Product
PageLayer
Affected
up to 1.8.7
What to do
Affects up to 1.8.7. Update PageLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 9, 2024PageLayer: Missing AuthorizationCVE-2024-30465 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Pagelayer Team PageLayer.This issue affects PageLayer: from n/a through 1.8.1.
Product
PageLayer
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update PageLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024Page Builder: Pagelayer – Drag and Drop website builder: Stored Cross-Site ScriptingCVE-2024-2504 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'attr' parameter in all versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2024Page Builder: Pagelayer – Drag and Drop website builder: Stored Cross-Site ScriptingCVE-2024-2127 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom attributes in all versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2024Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2023-7115 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Page Builder: Pagelayer
Fixed in
1.8.1
What to do
Update Page Builder: Pagelayer to 1.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 23, 2024Page Builder: Pagelayer – Drag and Drop website builder: Stored Cross-Site ScriptingCVE-2024-1590 · WordPress plugins & themes · reported by WordfenceMedium 4.6
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Widget in all versions up to, and including, 1.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 29, 2024Page Builder: Pagelayer: Doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer codeCVE-2023-5124 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer code, even when unfiltered_html is disallowed, such as in multi-site WordPress configurations.
Product
Page Builder: Pagelayer
Fixed in
1.8.0
What to do
Update Page Builder: Pagelayer to 1.8.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2024Page Builder: Pagelayer – Drag and Drop website builder: Stored Cross-Site ScriptingCVE-2023-6738 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagelayer_header_code', 'pagelayer_body_open_code', and 'pagelayer_footer_code' meta fields in all versions up to, and including, 1.7.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This appears to be a reintroduction of a vulnerability patched in version 1.7.7.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2023Page Builder: Pagelayer: Doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer codeCVE-2023-5087 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code.
Product
Page Builder: Pagelayer
Fixed in
1.7.8
What to do
Update Page Builder: Pagelayer to 1.7.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Page Builder: Pagelayer: Doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled postsCVE-2023-4687 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Page Builder: Pagelayer WordPress plugin before 1.7.7 doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled posts.
Product
Page Builder: Pagelayer
Fixed in
1.7.7
What to do
Update Page Builder: Pagelayer to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 7, 2021PageLayer before 1.3.5 allows reflected XSS via color settings.CVE-2020-36384 · Other software · Pagelayer · reported by MITREMedium 6.1
PageLayer before 1.3.5 allows reflected XSS via color settings.
Product
Pagelayer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wordfence.com wordfence.com
Jun 7, 2021PageLayer before 1.3.5 allows reflected XSS via the font-size parameter.CVE-2020-36383 · Other software · Pagelayer · reported by MITREMedium 6.1
PageLayer before 1.3.5 allows reflected XSS via the font-size parameter.
Product
Pagelayer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 31, 2020An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress.CVE-2020-35947 · WordPress plugins & themes · reported by MITREHigh 7.4
An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks, allowing these actions to be executed by anyone authenticated on the site. This happened because nonces were used as a means of authorization, but a nonce was present in a publicly viewable page. The greatest impact was the pagelayer_save_content function that allowed pages to be modified and allowed XSS to occur.
Product
An issue was discovered in the PageLayer
Fixed in
1.1.2
What to do
Update An issue was discovered in the PageLayer to 1.1.2 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Dec 31, 2020An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress.CVE-2020-35944 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vulnerable to CSRF, which can lead to XSS.
Product
An issue was discovered in the PageLayer
Fixed in
1.1.2
What to do
Update An issue was discovered in the PageLayer to 1.1.2 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.