CVE-2023-6738

The Pagelayer plugin for WordPress before version 1.7.9 contains a stored cross-site scripting vulnerability affecting the pagelayer_header_code, pagelayer_body_open_code, and pagelayer_footer_code meta fields. Attackers with contributor-level permissions or higher can inject malicious scripts through these fields because the plugin fails to properly sanitize inputs and escape outputs. When visitors access pages containing these injected scripts, the malicious code executes in their browsers. This flaw represents a return of a security issue that was supposedly fixed in version 1.7.7.

Based on public CVE data (MITRE/NVD).