Cross site scripting

2024-03-0720:15:00

PRIOn knowledge base

www.prio-n.com

page builder

wordpress

cross-site scripting

stored

plugin

vulnerable

input sanitization

output escaping

authenticated attackers

contributor level

arbitrary web scripts

nvd

6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom attributes in all versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.