The Pagelayer Drag and Drop website builder plugin for WordPress has a Reflected Cross‑Site Scripting flaw caused by inadequate sanitization of the ‘login_url’ parameter in all versions 2.0.0 and earlier. An attacker can embed malicious script code in that parameter, which is later echoed back to the user’s browser. When a victim clicks a crafted link or otherwise submits the malicious value, the script executes within the authenticated session. If the attacker has obtained a valid username/password pair, the injected code will run with the privileges of that user, potentially exposing sensitive data or hijacking the session.

All WordPress sites that have installed Page Builder: Pagelayer – Drag and Drop website builder version 2.0.0 or earlier are affected. The vulnerability resides in the plugin’s ajax handling code and is triggered when the ‘login_url’ parameter is used during any authenticated request.

The CVSS score of 4.7 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to provide a valid credential pair to trigger the injection, but an attacker can entice a victim to click a malicious link, so the risk to enterprises that maintain this plugin remains non‑negligible. The attack vector is via a reflected XSS payload delivered through the login_url parameter, exploiting unsanitized output rendering.