WordPress pagelayer has 15 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2020-35947 | An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks | high | 7.4 | <1.1.2 | 1.1.2 |
| CVE-2020-35944 | An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vulnerable to CSRF, whic | high | 8.8 | <1.1.2 | 1.1.2 |
| CVE-2023-4687 | The Page Builder: Pagelayer WordPress plugin before 1.7.7 doesn't prevent unauthenticated attackers from updating a post's header or footer | medium | 6.1 | <1.7.7 | 1.7.7 |
| CVE-2023-5087 | The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicio | medium | 5.4 | <1.7.8 | 1.7.8 |
| CVE-2024-2504 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'attr' | medium | 6.4 | <1.8.5 | 1.8.5 |
| CVE-2023-6738 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagel | medium | 5.4 | <=1.7.8 | – |
| CVE-2023-7115 | The Page Builder: Pagelayer WordPress plugin before 1.8.1 does not sanitise and escape some of its settings, which could allow high privileg | medium | 4.8 | <1.8.1 | 1.8.1 |
| CVE-2023-5124 | The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious J | medium | 4.8 | <1.8.0 | 1.8.0 |
| CVE-2024-1590 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin | medium | 4.6 | <1.8.3 | 1.8.3 |
| CVE-2024-8618 | The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | <1.9.0 | 1.9.0 |
| CVE-2024-2127 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom att | medium | 6.4 | <1.8.4 | 1.8.4 |
| CVE-2024-13430 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Information Exposure in all versions up to | medium | 4.3 | <1.9.9 | 1.9.9 |
| CVE-2024-8426 | The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privile | medium | 4.8 | <1.8.8 | 1.8.8 |
| CVE-2025-2104 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insuf | medium | 4.3 | <2.0.0 | 2.0.0 |
| CVE-2025-1926 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions | medium | 4.3 | <1.9.9 | 1.9.9 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked