https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-8618.htmlhttps://patchthecve.com/cve/CVE-2024-8618.htmlWed, 17 Jun 2026 08:22:59 +0000MEDIUM 4.8: The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-8426.htmlhttps://patchthecve.com/cve/CVE-2024-8426.htmlWed, 17 Jun 2026 08:22:33 +0000MEDIUM 4.8: The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowedhttps://patchthecve.com/cve/CVE-2025-2104.htmlhttps://patchthecve.com/cve/CVE-2025-2104.htmlWed, 17 Jun 2026 09:06:20 +0000MEDIUM 4.3: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insufficient validation on the pagelayer_save_content() function in all versions up to, and including, 1.9.8. This makes it possible for authenticated attackers, withttps://patchthecve.com/cve/CVE-2024-13430.htmlhttps://patchthecve.com/cve/CVE-2024-13430.htmlWed, 17 Jun 2026 07:01:59 +0000MEDIUM 4.3: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.8 via the 'pagelayer_builder_posts_shortcode' function due to insufficient restrictions on which posts can be included. This makes it possihttps://patchthecve.com/cve/CVE-2025-1926.htmlhttps://patchthecve.com/cve/CVE-2025-1926.htmlWed, 17 Jun 2026 08:40:21 +0000MEDIUM 4.3: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.8. This is due to missing or incorrect nonce validation on the pagelayer_save_post function. This makes it possible for unauthenticathttps://patchthecve.com/cve/CVE-2024-43972.htmlhttps://patchthecve.com/cve/CVE-2024-43972.htmlWed, 17 Jun 2026 07:52:05 +0000MEDIUM 5.9: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pagelayer Team PageLayer allows Stored XSS.This issue affects PageLayer: from n/a through 1.8.7.https://patchthecve.com/cve/CVE-2024-30465.htmlhttps://patchthecve.com/cve/CVE-2024-30465.htmlWed, 17 Jun 2026 07:27:01 +0000MEDIUM 6.5: Missing Authorization vulnerability in Pagelayer Team PageLayer.This issue affects PageLayer: from n/a through 1.8.1.https://patchthecve.com/cve/CVE-2024-2504.htmlhttps://patchthecve.com/cve/CVE-2024-2504.htmlWed, 17 Jun 2026 07:24:40 +0000MEDIUM 6.4: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'attr' parameter in all versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it poshttps://patchthecve.com/cve/CVE-2024-2127.htmlhttps://patchthecve.com/cve/CVE-2024-2127.htmlWed, 17 Jun 2026 07:23:46 +0000MEDIUM 6.4: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom attributes in all versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackehttps://patchthecve.com/cve/CVE-2023-7115.htmlhttps://patchthecve.com/cve/CVE-2023-7115.htmlWed, 17 Jun 2026 06:52:05 +0000MEDIUM 4.8: The Page Builder: Pagelayer WordPress plugin before 1.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)https://patchthecve.com/cve/CVE-2024-1590.htmlhttps://patchthecve.com/cve/CVE-2024-1590.htmlWed, 17 Jun 2026 07:04:35 +0000MEDIUM 4.6: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Widget in all versions up to, and including, 1.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes https://patchthecve.com/cve/CVE-2023-5124.htmlhttps://patchthecve.com/cve/CVE-2023-5124.htmlWed, 17 Jun 2026 06:47:35 +0000MEDIUM 4.8: The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer code, even when unfiltered_html is disallowed, such as in multi-site WordPress configurations.