CVE-2023-7115 in Pagelayer Plugin
Summary
by MITRE • 02/27/2024
The Page Builder: Pagelayer WordPress plugin before 1.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/14/2025
The vulnerability identified as CVE-2023-7115 affects the Page Builder: Pagelayer WordPress plugin version 1.8.1 and earlier, presenting a critical security risk through stored cross-site scripting flaws. This issue specifically targets high-privilege users such as administrators who possess the capability to manipulate plugin settings, potentially exploiting the lack of proper input sanitization and output escaping mechanisms within the plugin's codebase. The vulnerability manifests when users with administrative privileges can inject malicious scripts into plugin settings that persist and execute when other users access the affected pages, creating a persistent threat vector.
The technical flaw stems from insufficient sanitization and escaping of user-provided data within the plugin's administrative interfaces. When administrators configure plugin settings, the input values are not properly validated or escaped before being stored in the database and subsequently rendered on web pages. This failure to implement proper data sanitization techniques creates an environment where malicious scripts can be stored and executed without proper authorization, even in environments where the unfiltered_html capability has been restricted. The vulnerability is particularly concerning in multisite WordPress installations where such restrictions are commonly enforced to prevent unauthorized script execution across multiple sites within the same network.
The operational impact of this vulnerability extends beyond simple script injection, as it enables attackers with administrative privileges to potentially escalate their access within the WordPress environment. By leveraging stored XSS capabilities, malicious actors can execute scripts in the context of other users' browsers, potentially leading to session hijacking, data theft, or further compromise of the WordPress installation. The vulnerability's exploitation becomes more dangerous in multisite environments where a single compromised admin user could affect multiple sites within the network. This scenario aligns with attack patterns documented in the MITRE ATT&CK framework under the T1546.001 technique for "Event Triggered Execution" and T1059.001 for "Command and Scripting Interpreter", as the stored scripts can execute automatically when users view affected pages.
The security implications of CVE-2023-7115 are significant given that it targets plugin settings that are often accessed by administrators who may not be fully aware of the potential security risks associated with their inputs. The vulnerability's persistence through stored data makes it particularly dangerous as it can remain active even after the initial injection point is no longer visible to administrators. This characteristic places the vulnerability in the CWE-79 category for Cross-Site Scripting, specifically addressing the storage of malicious content rather than just reflected XSS attacks. Organizations should prioritize immediate patching to version 1.8.1 or later, as this update addresses the core sanitization and escaping issues that enable the vulnerability. Additionally, implementing proper input validation, output escaping, and restricting administrative privileges to only necessary users can help mitigate the risk of exploitation in environments where patching may not be immediately possible.