CVE-2026-2509 describes a stored XSS vulnerability in the Page Builder: Pagelayer WordPress plugin. The issue is due to an incomplete event handler blocklist in the 'pagelayer_xss_content' filtering function, which does not fully neutralize input in the Button widget's Custom Attributes field. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary scripts that execute in the context of users viewing the compromised pages. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality and integrity but not availability. No patch or official fix has been documented in the vendor or CVE data.

An attacker with Contributor-level or higher access can inject malicious scripts into pages via the Button widget's Custom Attributes field. These scripts execute in the browsers of users who view the infected pages, potentially leading to unauthorized actions or data exposure within the scope of the affected site. The vulnerability does not affect availability and requires authenticated access, limiting the attack surface. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only. Consider disabling or limiting use of the Button widget's Custom Attributes field if feasible. Monitor official vendor channels for updates or patches addressing this vulnerability.