Plugin security history

Page Builder: Pagelayer – Drag and Drop website builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 30 vulnerability records associated with Page Builder: Pagelayer – Drag and Drop website builder, published between 2020 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

30Total records

0Critical

3High

27Medium

0Low

0Informational

30Patched records

0Currently marked unpatched

2020-05-28First disclosure

2026-06-12Latest disclosure

29 of 30CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2020	4	4 records
2023	5	5 records
2024	9	9 records
2025	7	7 records
2026	5	5 records

Severity Breakdown

Severity	Records	Share
High	3	10%
Medium	27	90%

Vulnerability-Type Breakdown

Cross-Site Scripting

19 records63.3%

First: 2020. Latest: 2026.

Missing Authorization

6 records20%

First: 2023. Latest: 2026.

CSRF

2 records6.7%

First: 2020. Latest: 2025.

Privilege Escalation

1 record3.3%

First: 2025. Latest: 2025.

Information Disclosure

1 record3.3%

First: 2026. Latest: 2026.

Other

1 record3.3%

First: 2026. Latest: 2026.

Patch Status

Patched: 30
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

2.1.0
2.0.9
2.0.8
2.0.6
2.0.1
2.0.0
1.9.9
1.9.5
1.9.0
1.8.8
1.8.2
1.8.5
1.8.4
1.8.3
1.8.0
1.7.9
1.8.1
1.7.8
1.7.7
1.3.5
1.1.2

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-2.0.9`	Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'	June 12, 2026	2.1.0	Medium
`*-2.0.9`	Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block	June 12, 2026	2.1.0	Medium
`*-2.0.8`	Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes	April 7, 2026	2.0.9	Medium
`*-2.0.7`	Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'	March 27, 2026	2.0.8	Medium
`*-2.0.8`	PageLayer <= 2.0.8 - Authenticated (Contributor+) Information Exposure	March 12, 2026	2.0.9	Medium
`*-2.0.5`	Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference	November 12, 2025	2.0.6	Medium
`*-2.0.0`	Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter	May 23, 2025	2.0.1	Medium
`*-2.0.0`	Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link	May 23, 2025	2.0.1	Medium
`*-1.9.8`	Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication	March 12, 2025	2.0.0	Medium
`*-1.9.8`	Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode	March 11, 2025	1.9.9	Medium
`*-1.9.8`	Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification	March 9, 2025	1.9.9	Medium
`*-1.9.4`	PageLayer <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	January 24, 2025	1.9.5	Medium
`*-1.8.9`	Page Builder: Pagelayer <= 1.8.9 - Authenticated (Admin+) Stored Cross-Site Scripting	September 4, 2024	1.9.0	Medium
`*-1.8.7`	PageLayer <= 1.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting	August 28, 2024	1.8.8	Medium
`*-1.8.7`	Page Builder: Pagelayer <= 1.8.7 - Authenticated (Admin+) Stored Cross-Site Scripting	July 28, 2024	1.8.8	Medium
`*-1.8.1`	PageLayer <= 1.8.1 - Missing Authorization	March 28, 2024	1.8.2	Medium
`*-1.8.4`	Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes	March 21, 2024	1.8.5	Medium
`*-1.8.3`	Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes	March 7, 2024	1.8.4	Medium
`*-1.8.2`	Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button	February 22, 2024	1.8.3	Medium
`[*, 1.8.0)`	Pagelayer <= 1.7.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via Header/Footer code	January 31, 2024	1.8.0	Medium
`*-1.7.8`	PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields	January 3, 2024	1.7.9	Medium
`*-1.7.9`	Page Builder: Pagelayer <= 1.7.9 - Authenticated (Admin+) Stored Cross-Site Scripting	December 24, 2023	1.8.1	Medium
`*-1.7.7`	PageLayer <= 1.7.7 - Cross-Site Request Forgery via pagelayer_load_plugin	December 1, 2023	1.7.8	Medium
`*-1.7.7`	Page Builder: Pagelayer <= 1.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via Header/Footer	September 25, 2023	1.7.8	Medium
`*-1.7.6`	Page Builder: Pagelayer – Drag and Drop website builder <= 1.7.6 - Missing Authorization to Stored Cross-Site Scripting	September 25, 2023	1.7.7	High

Selected source records

Latest Records

MediumCVE-2026-2470

Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'

Published: June 12, 2026

Affected versions: *-2.0.9
Patched versions: 2.1.0

Original Wordfence record

MediumCVE-2026-3297

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block

Published: June 12, 2026

Affected versions: *-2.0.9
Patched versions: 2.1.0

Original Wordfence record

MediumCVE-2026-2509

Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes

Published: April 7, 2026

Affected versions: *-2.0.8
Patched versions: 2.0.9

Original Wordfence record

MediumCVE-2026-2442

Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'

Published: March 27, 2026

Affected versions: *-2.0.7
Patched versions: 2.0.8

Original Wordfence record

MediumCVE-2026-39469

PageLayer <= 2.0.8 - Authenticated (Contributor+) Information Exposure

Published: March 12, 2026

Affected versions: *-2.0.8
Patched versions: 2.0.9

Original Wordfence record

MediumCVE-2025-12366

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference

Published: November 12, 2025

Affected versions: *-2.0.5
Patched versions: 2.0.6

Original Wordfence record

MediumCVE-2025-4223

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter

Published: May 23, 2025

Affected versions: *-2.0.0
Patched versions: 2.0.1

Original Wordfence record

MediumCVE-2024-13427

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link

Published: May 23, 2025

Affected versions: *-2.0.0
Patched versions: 2.0.1

Original Wordfence record

Highest-Severity Records

HighCVE-2020-35944

Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Cross-Site Request Forgery to Cross-Site Scripting

Published: May 28, 2020

Affected versions: [*, 1.1.2)
Patched versions: 1.1.2

Original Wordfence record

HighCVE-2020-35947

Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Missing Authorization to Cross-Site Scripting

Published: May 28, 2020

Affected versions: [*, 1.1.2)
Patched versions: 1.1.2

Original Wordfence record

HighCVE-2023-4687

Page Builder: Pagelayer – Drag and Drop website builder <= 1.7.6 - Missing Authorization to Stored Cross-Site Scripting

Published: September 25, 2023

Affected versions: *-1.7.6
Patched versions: 1.7.7

Original Wordfence record

MediumCVE-2025-24573

PageLayer <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: January 24, 2025

Affected versions: *-1.9.4
Patched versions: 1.9.5

Original Wordfence record

MediumCVE-2024-13427

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link

Published: May 23, 2025

Affected versions: *-2.0.0
Patched versions: 2.0.1

Original Wordfence record

MediumCVE-2026-2509

Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes

Published: April 7, 2026

Affected versions: *-2.0.8
Patched versions: 2.0.9

Original Wordfence record

MediumCVE-2024-2127

Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes

Published: March 7, 2024

Affected versions: *-1.8.3
Patched versions: 1.8.4

Original Wordfence record

MediumCVE-2026-3297

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block

Published: June 12, 2026

Affected versions: *-2.0.9
Patched versions: 2.1.0

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory