CVE-2026-3297 is a stored cross-site scripting vulnerability in the Page Builder: Pagelayer WordPress plugin (up to version 2.0.9). The issue is due to improper neutralization of input during web page generation in the Anchor block, enabling authenticated attackers with contributor or higher privileges to inject arbitrary scripts. These scripts execute in the context of users who visit the compromised pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4, indicating a medium severity vulnerability with network attack vector, low attack complexity, and no user interaction required.

An attacker with contributor-level access or higher can inject malicious scripts into pages via the Anchor block. These scripts execute in the browsers of users who view the affected pages, potentially compromising user sessions or performing unauthorized actions within the context of the victim's browser. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the vendor's advisories for updates and apply any official fixes once available. Until then, restricting contributor-level access and above to trusted users may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.