CVE-2025-24573: PageLayer Plugin DOM-Based XSS Vulnerability

CVE-2025-24573 Overview

CVE-2025-24573 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the Softaculous PageLayer WordPress plugin. The flaw stems from improper neutralization of user input during web page generation, classified as [CWE-79]. All versions of PageLayer up to and including 1.9.4 are affected. Authenticated attackers with low privileges can inject malicious scripts that execute in the browsers of users who interact with crafted content. Successful exploitation requires user interaction and yields limited impact on confidentiality, integrity, and availability across a changed security scope.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions within the WordPress admin context.

Affected Products

• Softaculous PageLayer WordPress plugin versions up to and including 1.9.4
• WordPress sites using PageLayer for page building functionality
• Any deployment permitting untrusted contributors or editors to author content

Discovery Timeline

• 2025-01-24 - CVE CVE-2025-24573 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24573

Vulnerability Analysis

The vulnerability resides in the client-side rendering logic of the PageLayer plugin. PageLayer processes user-supplied input and writes it into the Document Object Model (DOM) without sufficient sanitization or encoding. This allows attacker-controlled data to be interpreted as executable JavaScript when the page is rendered in a victim's browser.

DOM-based XSS differs from reflected or stored XSS because the injection sink resides in client-side script rather than server-generated markup. Traditional server-side filters and Web Application Firewall (WAF) rules that inspect HTTP responses may not detect the malicious payload because it never appears in the server response body in a sanitizable form.

Exploitation requires the attacker to hold at least a low-privilege authenticated account and to trick a user into visiting or interacting with a crafted page. The scope change indicated by the CVSS vector means the executed script can affect resources beyond the vulnerable component itself, such as the broader WordPress administrative interface.

Root Cause

The root cause is missing or inadequate output encoding when PageLayer inserts user-controlled values into DOM sinks such as innerHTML, document.write, or dynamically constructed attribute values. Input that should be treated as data is instead parsed as HTML and JavaScript by the browser.

Attack Vector

An authenticated attacker crafts a page or element using PageLayer that embeds a malicious JavaScript payload in a field processed client-side by the plugin. When a victim (typically an administrator or editor) loads the affected page in the WordPress dashboard or front-end preview, the script executes with the victim's privileges. Actions may include exfiltrating session cookies, performing administrative operations via forged requests, or pivoting to further compromise.

Refer to the Patchstack WordPress Plugin Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-24573

Indicators of Compromise

• Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs embedded in PageLayer-authored content
• Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading PageLayer pages
• New or modified WordPress administrator accounts created without a corresponding legitimate change record
• Suspicious plugin, theme, or user modifications originating from valid admin sessions

Detection Strategies

• Audit PageLayer post and page content in the wp_posts and wp_postmeta tables for script tags, encoded payloads, and unusual attribute values
• Deploy browser Content Security Policy (CSP) violation reporting to surface inline script execution attempts
• Correlate WordPress audit logs with edge access logs to identify anomalous authenticated activity from low-privilege accounts

Monitoring Recommendations

• Enable a WordPress activity log plugin to capture content creation and modification events by contributor and editor accounts
• Monitor authentication logs for unusual login patterns preceding page edits by low-privilege users
• Alert on administrator session cookies being transmitted to unexpected destinations

How to Mitigate CVE-2025-24573

Immediate Actions Required

• Update the Softaculous PageLayer plugin to a version later than 1.9.4 as soon as a patched release is available
• Restrict content authoring permissions and review recently created or modified pages built with PageLayer
• Rotate administrator credentials and invalidate active sessions if suspicious activity is identified

Patch Information

Consult the Patchstack advisory for the fixed version and vendor guidance. Apply updates through the WordPress plugin management interface or via automated update tooling.

Workarounds

• Temporarily disable the PageLayer plugin on sites where trusted authoring cannot be enforced
• Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
• Limit editor and contributor accounts to reduce the pool of accounts that can stage an XSS payload

# Example CSP header restricting inline script execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; report-uri /csp-report"