Reflected Cross-Site Scripting Vulnerability in Pagelayer WordPress Plugin
CVE-2025-4223
4.7MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 24 May 2025
What is CVE-2025-4223?
The Pagelayer plugin for WordPress is susceptible to a reflected cross-site scripting vulnerability caused by inadequate input validation and output encoding in the login_url parameter. Attackers can exploit this weakness to inject malicious web scripts into web pages. This exploitation requires that a user is tricked into clicking a specially crafted link, thereby executing the injected scripts within the context of the authenticated user's session. This can potentially lead to unauthorized actions being performed on behalf of the user.
Affected Version(s)
Page Builder: Pagelayer – Drag and Drop website builder * <= 2.0.0