Skip to contentSoftaculous Pagelayer vulnerabilities
- softaculous page builder: pagelayer – drag and drop website builderPagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'CVE-2026-24704.3 Medium
- softaculous page builder: pagelayer – drag and drop website builderPage Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor BlockCVE-2026-32976.4 Medium
- softaculous page builder: pagelayer – drag and drop website builderPage Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom AttributesCVE-2026-25096.4 Medium
- softaculous pagelayerWordPress PageLayer plugin <= 2.0.8 - Sensitive Data Exposure vulnerabilityCVE-2026-394694.3 Medium
- softaculous page builder: pagelayer – drag and drop website builderPagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'CVE-2026-24425.3 Medium
- softaculous page builder: pagelayer – drag and drop website builderPage Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object ReferenceCVE-2025-123664.3 Medium
- softaculous page builder: pagelayer – drag and drop website builderPage Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url ParameterCVE-2025-42234.7 Medium
- softaculous page builder: pagelayer – drag and drop website builderPage Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button LinkCVE-2024-134276.4 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePage Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post PublicationCVE-2025-21044.3 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePage Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcodeCVE-2024-134304.3 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePage Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents ModificationCVE-2025-19264.3 Medium
- softaculous pagelayerWordPress Pagelayer plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-245736.5 Medium
- pagelayer team pagelayerWordPress Pagelayer plugin <= 1.7.7 - Broken Access Control vulnerabilityCVE-2023-491964.3 Medium
- pagelayerWordPress Page Builder: Pagelayer – Drag and Drop website builder plugin <= 1.8.7 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-439725.9 Medium
- pagelayerWordPress PageLayer plugin <= 1.8.1 - Broken Access Control vulnerabilityCVE-2024-304656.5 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePage Builder: Pagelayer – Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributesCVE-2024-25046.4 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePage Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom AttributesCVE-2024-21276.4 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePage Builder: Pagelayer – Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ButtonCVE-2024-15904.6 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fieldsCVE-2023-67385.4 Medium