CVE-2020-35947

The PageLayer plugin before version 1.1.2 contained multiple AJAX endpoints that failed to properly verify user permissions, enabling any authenticated user to execute these actions. The vulnerability stemmed from relying solely on nonces for authorization while exposing those nonces in publicly accessible pages. The most severe consequence involved the pagelayer_save_content function, which could be exploited to alter page content and inject malicious scripts via cross-site scripting attacks.

Based on public CVE data (MITRE/NVD).