Stored Cross-Site Scripting Vulnerability in Pagelayer Website Builder for WordPress

CVE-2024-13427

What is CVE-2024-13427?

The Pagelayer plugin, a drag-and-drop website builder for WordPress, is susceptible to Stored Cross-Site Scripting (XSS) vulnerabilities through its Button widget. This occurs due to inadequate sanitization and escaping of user-supplied attributes, permitting authenticated attackers with contributor-level access and above to inject malicious web scripts. These scripts execute whenever a user accesses the compromised pages. A partial fix was issued in version 1.9.9, and the issue was fully resolved in version 2.0.1.

References