CVE-2023-6738 in PageLayer Plugin
Summary
by MITRE • 01/04/2024
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagelayer_header_code', 'pagelayer_body_open_code', and 'pagelayer_footer_code' meta fields in all versions up to, and including, 1.7.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This appears to be a reintroduction of a vulnerability patched in version 1.7.7.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/11/2026
The vulnerability identified as CVE-2023-6738 affects the Pagelayer WordPress plugin, specifically targeting versions up to and including 1.7.8. This represents a critical security flaw that enables stored cross-site scripting attacks through three designated meta fields: 'pagelayer_header_code', 'pagelayer_body_open_code', and 'pagelayer_footer_code'. The issue stems from inadequate input sanitization and output escaping mechanisms that fail to properly validate or escape user-supplied content before it is stored and subsequently rendered on web pages. This vulnerability is particularly concerning as it affects authenticated users with contributor-level permissions or higher, making it exploitable by individuals who already possess some degree of administrative access to the WordPress site.
The technical implementation of this vulnerability allows attackers to inject malicious scripts that will execute whenever any user accesses a page containing the injected code. This stored XSS attack vector operates by leveraging the plugin's meta fields that are designed to accept custom code snippets for header, body opening, and footer sections of web pages. The vulnerability's persistence stems from the fact that the malicious code is stored in the database and executed each time the affected pages are loaded, rather than requiring a one-time exploitation. This behavior aligns with CWE-79, which classifies cross-site scripting vulnerabilities as a result of insufficient input validation and output escaping. The flaw effectively transforms legitimate plugin functionality into a vector for malicious code execution, potentially allowing attackers to steal session cookies, perform unauthorized actions on behalf of users, or redirect them to malicious websites.
From an operational perspective, this vulnerability creates significant risk for WordPress sites using the Pagelayer plugin, particularly those with multiple contributors or users who may have elevated privileges. The impact extends beyond simple script injection as it can enable more sophisticated attacks such as session hijacking, data exfiltration, or the installation of backdoors through the execution of malicious scripts. The vulnerability's reintroduction in version 1.7.8 after being patched in 1.7.7 demonstrates a regression that may have been introduced during code development or testing phases, highlighting the importance of thorough regression testing in security updates. The fact that this affects users with contributor-level permissions means that even relatively low-privilege accounts can potentially compromise the entire site's security, as these users can inject code that will execute for all visitors.
The security implications of this vulnerability align with ATT&CK framework techniques such as T1566, which covers the exploitation of vulnerabilities to gain initial access or execute malicious code, and T1059, which covers command and scripting interpreter usage. Organizations should consider this vulnerability as part of their broader threat landscape, particularly when assessing the security posture of WordPress installations that utilize drag-and-drop page builders. The vulnerability also demonstrates the importance of maintaining current security patches and the risks associated with plugin updates that may inadvertently reintroduce previously fixed issues. Mitigation strategies should include immediate patching to version 1.7.9 or later, implementation of additional input validation measures, and monitoring for any suspicious activity in the affected meta fields. Regular security audits of plugin installations and user permission management should be implemented to prevent exploitation of similar vulnerabilities in the future.