CVE-2026-3297: Pagelayer Plugin Stored XSS Vulnerability via Anchor Block

Technical summary

CVE-2026-3297 is a Stored Cross-Site Scripting (XSS) vulnerability in Pagelayer versions up to 2.0.9. The vulnerability exists in the Anchor block functionality, which fails to sanitize user input during creation and does not properly escape output during rendering. This allows authenticated contributors and above to persistently inject JavaScript payloads into page content. The injected scripts execute in the context of any user viewing the affected page, including administrators, making this a post-authentication but high-impact flaw.

Business impact

A compromised Pagelayer installation can serve as a vector to steal admin credentials, modify website content, redirect visitors to malicious sites, or distribute malware. For WordPress site operators, this reduces the trustworthiness of their platform and exposes visitors to secondary attacks. Organizations relying on Pagelayer for client websites face reputational and legal liability if visitor data is compromised. The requirement for contributor-level access limits immediate risk in well-governed environments but is a significant concern in multi-author or agency setups.

Affected systems

The vulnerability affects Pagelayer versions 2.0.9 and earlier. Any WordPress site running an affected version with the plugin active is vulnerable if one or more user accounts with contributor, author, editor, or administrator role exist. The risk is elevated in WordPress installations where contributor accounts are assigned to untrusted or compromised users.

Exploitability

Exploitation requires authenticated access (contributor level or above) and knowledge of the Pagelayer page builder interface. An attacker cannot exploit this remotely without valid credentials. However, in shared hosting, agency, or multi-author blog environments, the bar to obtaining contributor access is often low. No user interaction is required beyond the initial page creation—scripts execute automatically when the page is viewed. The straightforward nature of XSS injection via a UI block makes this practical for a motivated insider or credential-compromised user.

Remediation

Update Pagelayer to the latest version that patches this vulnerability. Verify the patched version against the plugin's official repository. As an interim measure, restrict contributor-level access to trusted users only and monitor page creation activity. Consider using a Web Application Firewall (WAF) rule to detect and block common XSS payloads in Pagelayer requests. Audit existing pages for suspicious Anchor block content.

Patch guidance

Check the Pagelayer plugin repository or the vendor's security advisory for the patched version released after 2.0.9. Apply the update through the WordPress plugin management interface or via your hosting provider. Test the update in a staging environment before rolling out to production, as page builder updates can occasionally affect page layouts. After patching, audit any pages created during the vulnerable window for injected content.

Detection guidance

Monitor WordPress database queries and logs for unusual activity in the Pagelayer tables, particularly inserts or updates to Anchor block data containing script tags or event handlers. Check page post_content fields for suspicious JavaScript, especially if stored in Anchor blocks. Review user access logs to identify which contributor-level accounts have recently created or modified pages. Deploy a WAF rule or security plugin to inspect outbound page HTML for unexpected script execution. Consider using a WordPress security scanner capable of detecting stored XSS patterns.

Why prioritize this

Although the CVSS score of 6.4 (MEDIUM) reflects the authentication requirement, the practical impact is significant: a single compromised or malicious contributor account can compromise every visitor to the site. The simplicity of exploitation via the UI and the post-authentication nature make this a high-priority fix for WordPress sites allowing multiple user roles. Sites with aggressive content collaboration should prioritize this above other medium-severity issues.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects a network-accessible vulnerability (AV:N) requiring low privileges (PR:L), no user interaction (UI:N), and a changed scope (S:C) resulting in low confidentiality and integrity impact (C:L, I:L). The score appropriately penalizes the authentication requirement but does not fully capture the insider-threat aspect or the broad exposure to site visitors. In environments with permissive contributor access, the real-world risk may be higher.

Frequently asked questions