What’s Vulnerable › Vulnerabilities

CVE-2023-4687: PageLayer < 1.7.7 - Unauthenticated Stored XSS

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-16 · updated 2026-06-17

Description

The Page Builder: Pagelayer WordPress plugin before 1.7.7 doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled posts.

Affected products

• softaculous Page Builder: Pagelayer – Drag and Drop website builder: before 1.7.7 — fixed in 1.7.7

How to fix

Upgrade to a fixed version: softaculous Page Builder: Pagelayer – Drag and Drop website builder 1.7.7. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/31596fc5-4203-40c4-9b0a-e8a37faafddd
• https://wpscan.com/vulnerability/31596fc5-4203-40c4-9b0a-e8a37faafddd

Get alerted when CVE-2023-4687 or the next vulnerability affects your stack