TI-2020-18385 Aliases CVE-2020-35944 GHSA-6753-4jpx-jv2w

An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress.

LOW 39CWE-352Published 2021-01-01 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering, Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352 and CWE-79.

Summary

An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vulnerable to CSRF, which can lead to XSS.

Why it matters now

EPSS 0.00783 56th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pagelayer:pagelayer::::::wordpress::*	before 1.1.2	Vulnerable	Pagelayer

cpe:2.3:a:pagelayer:pagelayer:*:*:*:*:*:wordpress:*:* Versions before 1.1.2 Vulnerable ·Pagelayer

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-35944
2026-10-03 Alias added: GHSA-6753-4jpx-jv2w

References

Exploit 2

TI-2023-04319 PageLayer < 1.7.7 - Unauthenticated Stored XSS CVSS 3.1MEDIUM 6.1
TI-2023-04681 PageLayer < 1.7.8 - Author+ Stored XSS CVSS 3.1MEDIUM 5.4
TI-2024-07994 Page Builder: Pagelayer < 1.9.0- Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2024-07811 Pagelayer < 1.8.8 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2023-04713 PageLayer < 1.8.0 - Author+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2024-20191 WordPress PageLayer plugin <= 1.8.1 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences