Advisories · Technology
softaculous Page Builder: Pagelayer – Drag and Drop website builder.
Every CVE that names softaculous Page Builder: Pagelayer – Drag and Drop website builder among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'
- softaculous Page Builder: Pagelayer – Drag and Drop website builder
- Broken access control
- CVSS 6.4 Medium
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block
- softaculous Page Builder: Pagelayer – Drag and Drop website builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
- softaculous Page Builder: Pagelayer – Drag and Drop website builder
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'
- softaculous Page Builder: Pagelayer – Drag and Drop website builder
- Other injection
- CVSS 4.3 Medium
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference
- softaculous Page Builder: Pagelayer – Drag and Drop website builder
- Broken access control
- CVSS 4.7 Medium
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter
- softaculous Page Builder: Pagelayer – Drag and Drop website builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link
- softaculous Page Builder: Pagelayer – Drag and Drop website builder
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication
- softaculous Page Builder: Pagelayer – Drag and Drop website builder
- Broken access control
- CVSS 4.3 Medium
Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode
- softaculous Page Builder: Pagelayer – Drag and Drop website builder
- Broken access control
- CVSS 4.3 Medium
Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification
- softaculous Page Builder: Pagelayer – Drag and Drop website builder
- Cross-site request forgery (CSRF)
- CVSS 6.4 Medium
Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes
- softaculous Page Builder: Pagelayer – Drag and Drop website builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes
- softaculous Page Builder: Pagelayer – Drag and Drop website builder
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button
- softaculous Page Builder: Pagelayer – Drag and Drop website builder
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields
- softaculous Page Builder: Pagelayer – Drag and Drop website builder
- CWE-20