CVE-2024-13427 – WordPress Pagelayer Stored Cross-Site Scripting

May 24, 2025

CVE ID : CVE-2024-13427

Published : May 24, 2025, 3:15 a.m. | 1 hour, 38 minutes ago

Description : The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s Button widget in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 1.9.9 and completely fixed in version 2.0.1.

Severity: 6.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Source: Read More

Previous ArticleCVE-2025-48752 – Apache Process-Sync Pthread Mutex Unlock Vulnerability

Next Article CVE-2025-48753 – “Anode SpinLock Data Race Vulnerability”

Newest LF Decentralized Trust Lab HOPrS identifies if photos have been altered

Coder reimagines development environments to make them more ideal for AI agents

Report: AI coding productivity gains cancelled out by other friction points that slow developers down

15 Proven Benefits of Outsourcing Node.js Development for Large Organizations

Cor, blimey! The ASUS ROG Ally drops to its lowest-ever price for Amazon Prime Day in the UK — the only Windows handheld to permanently replace my Steam Deck

Owlcat Games talks to us about about WH40K: Rogue Trader, the next game ‘Dark Heresy’ — and how the studio feels about working with Xbox Game Pass

Microsoft says ‘we have threads at home’ — rolls out feature Slack has had for years

Subnautica 2 publisher Krafton reportedly delayed it to 2026 — did it just kill a $250 million bonus for devs in the crib?

Cally – Small, feature-rich calendar components

Cally – Small, feature-rich calendar components

Working with the Command Line and WP-CLI

Access to Care Is Evolving: What Consumer Insights and Behavior Models Reveal

Cor, blimey! The ASUS ROG Ally drops to its lowest-ever price for Amazon Prime Day in the UK — the only Windows handheld to permanently replace my Steam Deck

Cor, blimey! The ASUS ROG Ally drops to its lowest-ever price for Amazon Prime Day in the UK — the only Windows handheld to permanently replace my Steam Deck

Owlcat Games talks to us about about WH40K: Rogue Trader, the next game ‘Dark Heresy’ — and how the studio feels about working with Xbox Game Pass

Microsoft says ‘we have threads at home’ — rolls out feature Slack has had for years

CVE-2024-13427 – WordPress Pagelayer Stored Cross-Site Scripting

Over 1,000 SOHO Devices Hacked in China-linked LapDogs Cyber Espionage Campaign

Blind Eagle Uses Proton66 Hosting for Phishing, RAT Deployment on Colombian Banks

You can now say “Hey Copilot” to trigger the AI assistant in Windows 11

CVE-2024-49350 – IBM Db2 Denial of Service Vulnerability

Spf Permerror Troubleshooting Guide For Better Email Deliverability Today

CVE-2025-3486 – Allegra ZipEntry Valide Directory Traversal Remote Code Execution Vulnerability

Build scalable containerized RAG based generative AI applications in AWS using Amazon EKS with Amazon Bedrock

CVE-2025-6660 – PDF-XChange Editor GIF File Parsing Remote Code Execution Vulnerability

ether0: A 24B LLM Trained with Reinforcement Learning RL for Advanced Chemical Reasoning Tasks

CVE-2025-32977 – Quest KACE Unauthenticated Backup Upload

CVE-2024-13427 – WordPress Pagelayer Stored Cross-Site Scripting

Related Posts