VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Page Builder: Pagelayer – Drag and Drop website builder security & vulnerabilities

pagelayer— active installsLast vulnerability Jun 12, 2026

No known unpatched vulnerabilities in the latest version

All 30 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
30Known vulnerabilities
  • Critical0
  • High3
  • Medium27
  • Low0
Vulnerabilities per year
2020: 4 vulnerabilities4202023: 5 vulnerabilities5232024: 9 vulnerabilities9242025: 7 vulnerabilities7252026: 5 vulnerabilities526

All Page Builder: Pagelayer – Drag and Drop website builder vulnerabilities

Page Builder: Pagelayer – Drag and Drop website builder vulnerabilities
SeverityVulnerabilityCVEPublished
Medium4.3Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'
≤2.0.9Update to 2.1.0
CVE-2026-2470
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block
≤2.0.9Update to 2.1.0
CVE-2026-3297
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
≤2.0.8Update to 2.0.9
CVE-2026-2509
Medium5.3Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'
≤2.0.7Update to 2.0.8
CVE-2026-2442
Medium4.3Authenticated (Contributor+) Information Exposure
≤2.0.8Update to 2.0.9
CVE-2026-39469
Medium4.3Authenticated (Author+) Insecure Direct Object Reference
≤2.0.5Update to 2.0.6
CVE-2025-12366
Medium4.7Reflected Cross-Site Scripting via login_url Parameter
≤2.0.0Update to 2.0.1
CVE-2025-4223
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link
≤2.0.0Update to 2.0.1
CVE-2024-13427
Medium4.3Missing Authorization to Authenticated (Contributor+) Post Publication
≤1.9.8Update to 2.0.0
CVE-2025-2104
Medium4.3Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode
≤1.9.8Update to 1.9.9
CVE-2024-13430
Medium4.3Cross-Site Request Forgery (CSRF) To Post Contents Modification
≤1.9.8Update to 1.9.9
CVE-2025-1926
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.9.4Update to 1.9.5
CVE-2025-24573
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤1.8.9Update to 1.9.0
CVE-2024-8618
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.8.7Update to 1.8.8
CVE-2024-43972
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤1.8.7Update to 1.8.8
CVE-2024-8426
Medium4.3Missing Authorization
≤1.8.1Update to 1.8.2
CVE-2024-30465
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes
≤1.8.4Update to 1.8.5
CVE-2024-2504
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes
≤1.8.3Update to 1.8.4
CVE-2024-2127
Medium4.6Authenticated (Contributor+) Stored Cross-Site Scripting via Button
≤1.8.2Update to 1.8.3
CVE-2024-1590
Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting via Header/Footer code
<1.8.0Update to 1.8.0
CVE-2023-5124
Medium5.4Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields
≤1.7.8Update to 1.7.9
CVE-2023-6738
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤1.7.9Update to 1.8.1
CVE-2023-7115
Medium5.3Cross-Site Request Forgery via pagelayer_load_plugin
≤1.7.7Update to 1.7.8
CVE-2023-49196
High7.2Missing Authorization to Stored Cross-Site Scripting
≤1.7.6Update to 1.7.7
CVE-2023-4687
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Header/Footer
≤1.7.7Update to 1.7.8
CVE-2023-5087
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<1.7.7Update to 1.7.7
—
Medium6.1Reflected Cross-Site Scripting via font-size
<1.3.5Update to 1.3.5
CVE-2020-36383
Medium6.1Reflected Cross-Site Scripting via Color Settings
<1.3.5Update to 1.3.5
CVE-2020-36384
High7.4Missing Authorization to Cross-Site Scripting
<1.1.2Update to 1.1.2
CVE-2020-35947
High8.8Cross-Site Request Forgery to Cross-Site Scripting
<1.1.2Update to 1.1.2
CVE-2020-35944

Page Builder: Pagelayer – Drag and Drop website builder: common questions

Does Page Builder: Pagelayer – Drag and Drop website builder have known vulnerabilities?

Yes. VulnCrest Radar lists 30 known vulnerabilities in Page Builder: Pagelayer – Drag and Drop website builder: 3 high, 27 medium. None are known to affect version null.

How do I check which version of Page Builder: Pagelayer – Drag and Drop website builder I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Page Builder: Pagelayer – Drag and Drop website builder vulnerability?

CVE-2026-2470, published Jun 12, 2026: Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'. Severity: Medium (CVSS 4.3).

Is any Page Builder: Pagelayer – Drag and Drop website builder vulnerability listed in CISA KEV?

No. None of the known Page Builder: Pagelayer – Drag and Drop website builder vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?