# softaculous Page Builder: Pagelayer – Drag and Drop website builder.

Every CVE that names softaculous Page Builder: Pagelayer – Drag and Drop website builder among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'](https://agentprime.io/advisories/CVE-2026-2470.md)
  `CVE-2026-2470` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 4.3 Medium · Not analysed yet · Published 13 Jun 2026 · Tags: Broken access control
- [Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block](https://agentprime.io/advisories/CVE-2026-3297.md)
  `CVE-2026-3297` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 6.4 Medium · Not analysed yet · Published 13 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes](https://agentprime.io/advisories/CVE-2026-2509.md)
  `CVE-2026-2509` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 6.4 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'](https://agentprime.io/advisories/CVE-2026-2442.md)
  `CVE-2026-2442` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 5.3 Medium · Not analysed yet · Published 28 Mar 2026 · Tags: Other injection
- [Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference](https://agentprime.io/advisories/CVE-2025-12366.md)
  `CVE-2025-12366` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 4.3 Medium · Not analysed yet · Published 13 Nov 2025 · Tags: Broken access control
- [Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter](https://agentprime.io/advisories/CVE-2025-4223.md)
  `CVE-2025-4223` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 4.7 Medium · Not analysed yet · Published 24 May 2025 · Tags: Cross-site scripting (XSS)
- [Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link](https://agentprime.io/advisories/CVE-2024-13427.md)
  `CVE-2024-13427` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 6.4 Medium · Not analysed yet · Published 24 May 2025 · Tags: Cross-site scripting (XSS)
- [Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication](https://agentprime.io/advisories/CVE-2025-2104.md)
  `CVE-2025-2104` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 4.3 Medium · Not analysed yet · Published 13 Mar 2025 · Tags: Broken access control
- [Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode](https://agentprime.io/advisories/CVE-2024-13430.md)
  `CVE-2024-13430` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 4.3 Medium · Not analysed yet · Published 12 Mar 2025 · Tags: Broken access control
- [Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification](https://agentprime.io/advisories/CVE-2025-1926.md)
  `CVE-2025-1926` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 4.3 Medium · Not analysed yet · Published 10 Mar 2025 · Tags: Cross-site request forgery (CSRF)
- [Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes](https://agentprime.io/advisories/CVE-2024-2504.md)
  `CVE-2024-2504` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 6.4 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: Cross-site scripting (XSS)
- [Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes](https://agentprime.io/advisories/CVE-2024-2127.md)
  `CVE-2024-2127` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 6.4 Medium · Not analysed yet · Published 7 Mar 2024 · Tags: Cross-site scripting (XSS)
- [Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button](https://agentprime.io/advisories/CVE-2024-1590.md)
  `CVE-2024-1590` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 4.6 Medium · Not analysed yet · Published 23 Feb 2024 · Tags: Cross-site scripting (XSS)
- [PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields](https://agentprime.io/advisories/CVE-2023-6738.md)
  `CVE-2023-6738` · CVE record: softaculous Page Builder: Pagelayer – Drag and Drop website builder · CVSS 5.4 Medium · Not analysed yet · Published 4 Jan 2024 · Tags: CWE-20

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=softaculous-page-builder-pagelayer-drag-and-drop-website-builder>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/softaculous-page-builder-pagelayer-drag-and-drop-website-builder/>. Everything for agents: <https://agentprime.io/llms.txt>.