CVE-2026-3297: Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor block in versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Page Builder: Pagelayerfrom your environment.Deactivate or uninstall the Pagelayer WordPress plugin if it is not required, and keep it removed until an official vendor fix is available.
- Configuration
Disable the Anchor block in the Pagelayer plugin (if the plugin UI/settings allow) to prevent stored XSS via anchor inputs.
Page Builder: Pagelayer - Anchor block enabled = false - Compensating control
Restrict page-editing capabilities to trusted accounts only: remove or limit Contributor+ roles' ability to add or edit pages/blocks, or temporarily revoke access to Pagelayer features for non-trusted users.
- Compensating control
Deploy WAF/content-security controls to block or sanitize malicious script payloads in page content (e.g., strip script tags or suspicious attributes in anchor elements) until a plugin patch is applied.
- Operational
Audit site content for injected scripts in pages (especially anchor blocks) and remove any malicious or unexpected script code; review recent edits by Contributor+ users for signs of exploitation.
- Operational
Monitor the plugin vendor for an official security update or patch, and apply the vendor-supplied update as soon as it is released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3297?
CVE-2026-3297 has a medium severity rating of 6.4.
How do I fix CVE-2026-3297?
To fix CVE-2026-3297, upgrade to the latest version of the Pagelayer plugin that addresses this vulnerability.
What type of vulnerability is CVE-2026-3297?
CVE-2026-3297 is classified as a stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-3297?
Authenticated users with Contributor+ permissions can exploit CVE-2026-3297.
What causes CVE-2026-3297?
CVE-2026-3297 is caused by insufficient input sanitization and output escaping in the Pagelayer plugin.