CVE-2024-13427 is a stored cross-site scripting vulnerability (CWE-79) in the Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress. The vulnerability arises from improper neutralization of input during web page generation, specifically in the Button widget where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with contributor-level permissions or higher to inject malicious scripts that persist in pages and execute when viewed by others. The vulnerability affects all versions up to 2.0.0. Partial remediation was introduced in version 1.9.9, with a complete fix implemented in version 2.0.1.

An attacker with contributor-level access or above can exploit this vulnerability to inject persistent malicious scripts into pages created with the plugin. These scripts execute in the context of users viewing the compromised pages, potentially leading to session hijacking, unauthorized actions, or data theft. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS 3.1 base score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Users should upgrade the Page Builder: Pagelayer plugin to version 2.0.1 or later, where the vulnerability is fully fixed. Versions prior to 2.0.1, including 2.0.0 and earlier, are vulnerable. No other vendor advisory or patch information is provided, so patch status is confirmed by the version history in the description. Applying the official update is the recommended remediation.