title: PageLayer < 1.8.0 - Author+ Stored XSS
description: The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer code, even when unfiltered_html is disallowed, such as in multi-site WordPress configurations.
problem types: CWE-79 Cross-Site Scripting (XSS)
affected:
{
vendor: Unknown
product: Page Builder: Pagelayer
versions:
status: affected, versionType: semver, version: 1.3.2, lessThan: 1.8.0
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}