What is the CVSS score of CVE-2026-2509?

CVE-2026-2509 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-2509

EUVD-2026-20465 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-5q87-jcg7-9vrx

GHSA-rcw8-rm48-wjhg

GHSA-wqwp-c8g7-73q2

GHSA-x727-7jhm-cmg5

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 14:16 euvd

EUVD-2026-20465

Analysis Generated

Apr 08, 2026 - 14:16 vuln.today

CVE Published

Apr 08, 2026 - 13:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Page Builder: Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget's Custom Attributes field in all versions up to, and including, 2.0.8. This is due to an incomplete event handler blocklist in the 'pagelayer_xss_content' XSS filtering function, which blocks common, but not all, event handlers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Page Builder: Pagelayer WordPress plugin versions up to 2.0.8 allows authenticated attackers with Contributor-level or higher privileges to inject arbitrary JavaScript into page content via the Button widget's Custom Attributes field. The vulnerability bypasses an incomplete XSS filter that blocks common event handlers but fails to block all variants, enabling persistent script execution whenever affected pages are viewed. No public exploit code or active exploitation has been confirmed; however, the low attack complexity and broad applicability to WordPress sites using this popular page builder plugin present meaningful risk.

Technical ContextAI

The Pagelayer plugin implements an XSS filtering function called 'pagelayer_xss_content' to sanitize user input in widget configuration. This function employs a blocklist approach targeting known event handler patterns (such as 'onclick', 'onload', etc.) in the Button widget's Custom Attributes field. However, the blocklist is incomplete and fails to account for alternative or lesser-known event handler names, attribute vectors, or encoding bypasses. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reliance on insufficient input validation rather than proper output encoding or a whitelist approach. The affected CPE (cpe:2.3:a:softaculous:page_builder:_pagelayer_-_drag_and_drop_website_builder:*:*:*:*:*:*:*:*) indicates the Pagelayer plugin by Softaculous. The vulnerability manifests when authenticated users with Contributor privileges or above craft malicious Custom Attributes containing unblocked event handler syntax, which the filter fails to strip before storage in the WordPress database.

RemediationAI

Update the Page Builder: Pagelayer plugin to version 2.0.9 or later, which includes a corrected XSS filtering mechanism that addresses the incomplete event handler blocklist. Immediately disable or restrict Contributor-level access on WordPress installations running Pagelayer 2.0.8 or earlier until the patch can be applied. As a temporary workaround, use a Web Application Firewall (WAF) or WordPress security plugin to monitor and block requests containing suspicious event handler patterns in page builder widget fields. Review all pages created or edited by Contributor-level users since plugin installation to identify and remove any injected scripts. Detailed remediation guidance is available via the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/915c119d-2bae-4ea6-babb-7e8e99054cd0?source=cve) and the WordPress plugin repository changeset (https://plugins.trac.wordpress.org/changeset/3479046/).