Skip to contentSoftaculous Page Builder: Pagelayer – Drag And Drop Website Builder vulnerabilities
- softaculous page builder: pagelayer – drag and drop website builderPagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'CVE-2026-24704.3 Medium
- softaculous page builder: pagelayer – drag and drop website builderPage Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor BlockCVE-2026-32976.4 Medium
- softaculous page builder: pagelayer – drag and drop website builderPage Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom AttributesCVE-2026-25096.4 Medium
- softaculous page builder: pagelayer – drag and drop website builderPagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'CVE-2026-24425.3 Medium
- softaculous page builder: pagelayer – drag and drop website builderPage Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object ReferenceCVE-2025-123664.3 Medium
- softaculous page builder: pagelayer – drag and drop website builderPage Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url ParameterCVE-2025-42234.7 Medium
- softaculous page builder: pagelayer – drag and drop website builderPage Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button LinkCVE-2024-134276.4 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePage Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post PublicationCVE-2025-21044.3 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePage Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcodeCVE-2024-134304.3 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePage Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents ModificationCVE-2025-19264.3 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePage Builder: Pagelayer – Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributesCVE-2024-25046.4 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePage Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom AttributesCVE-2024-21276.4 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePage Builder: Pagelayer – Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ButtonCVE-2024-15904.6 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fieldsCVE-2023-67385.4 Medium