Page Builder: Pagelayer – Drag and Drop website builder

Construct pages using frontend drag-and-drop functionality without coding. With over 400K active installations and a PF Score of 88.3, this tool ranks in the top 1% of WordPress plugins globally.

Generated on 8 Jul 2026. Score and stats mentioned may differ from current live data.

#379 Global Rank

400K+ active installs

3.9/5 102 ratings

Since 2019 7 years active

Vulnerabilities

30 Total

30 Patched

0 Active

100% Resolved rate

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor block in versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 2.0.9 Patched in ✓ 2.1.0 Published 12 Jun 2026 CVE CVE-2026-3297

Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'

CWE-863 · Incorrect Authorization

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.9. This is due to the pagelayer_save_content AJAX handler allowing users with basic post-edit capability to persist pagelayer_contact_templates metadata on posts they can edit (including pending posts), while the unauthenticated pagelayer_contact_submit endpoint later consumes that metadata by user-controlled post/form identifiers without enforcing a privileged or published-context boundary. This makes it possible for authenticated attackers, with Contributor-level access and above, to configure arbitrary contact-form mail templates that are usable through unauthenticated form submission via the contacts parameter. In typical deployments this template feature is configured via Pagelayer Pro UI; however, the vulnerable backend trust path is still present. This issue may be chained with CVE-2026-2442 to increase exploitability and attacker control over outbound email behavior.

4.3 Medium Affected All – 2.0.9 Patched in ✓ 2.1.0 Published 12 Jun 2026 CVE CVE-2026-2470

Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Page Builder: Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget's Custom Attributes field in all versions up to, and including, 2.0.8. This is due to an incomplete event handler blocklist in the 'pagelayer_xss_content' XSS filtering function, which blocks common, but not all, event handlers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 2.0.8 Patched in ✓ 2.0.9 Published 7 Apr 2026 CVE CVE-2026-2509

Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'

CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in all versions up to, and including, 2.0.7. This is due to the contact form handler performing placeholder substitution on attacker-controlled form fields and then passing the resulting values into email headers without removing CR/LF characters. This makes it possible for unauthenticated attackers to inject arbitrary email headers (for example Bcc / Cc) and abuse form email delivery via the 'email' parameter granted they can target a contact form configured to use placeholders in mail template headers.

5.3 Medium Affected All – 2.0.7 Patched in ✓ 2.0.8 Published 27 Mar 2026 CVE CVE-2026-2442

PageLayer <= 2.0.8 - Authenticated (Contributor+) Information Exposure

CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive user or configuration data.

4.3 Medium Affected All – 2.0.8 Patched in ✓ 2.0.9 Published 12 Mar 2026 CVE CVE-2026-39469

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference

CWE-639 · Authorization Bypass Through User-Controlled Key

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.5 via the pagelayer_replace_page function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to replace media files belonging to other users, including administrators.

4.3 Medium Affected All – 2.0.5 Patched in ✓ 2.0.6 Published 12 Nov 2025 CVE CVE-2025-12366

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 1.9.9 and completely fixed in version 2.0.1.

6.4 Medium Affected All – 2.0.0 Patched in ✓ 2.0.1 Published 23 May 2025 CVE CVE-2024-13427

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘login_url’ parameter in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. A valid username/password pair needs to be supplied in order to be successfully exploited and any injected scripts will only execute in the context of that authenticated user.

4.7 Medium Affected All – 2.0.0 Patched in ✓ 2.0.1 Published 23 May 2025 CVE CVE-2025-4223

Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication

CWE-862 · Missing Authorization

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insufficient validation on the pagelayer_save_content() function in all versions up to, and including, 1.9.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to bypass post moderation and publish posts to the site.

4.3 Medium Affected All – 1.9.8 Patched in ✓ 2.0.0 Published 12 Mar 2025 CVE CVE-2025-2104

Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode

CWE-284 · Improper Access Control

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.8 via the 'pagelayer_builder_posts_shortcode' function due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private posts that they should not have access to.

4.3 Medium Affected All – 1.9.8 Patched in ✓ 1.9.9 Published 11 Mar 2025 CVE CVE-2024-13430

Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification

CWE-352 · Cross-Site Request Forgery (CSRF)

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.8. This is due to missing or incorrect nonce validation on the pagelayer_save_post function. This makes it possible for unauthenticated attackers to modify post contents via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

4.3 Medium Affected All – 1.9.8 Patched in ✓ 1.9.9 Published 9 Mar 2025 CVE CVE-2025-1926

PageLayer <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The PageLayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 1.9.4 Patched in ✓ 1.9.5 Published 24 Jan 2025 CVE CVE-2025-24573

Page Builder: Pagelayer <= 1.8.9 - Authenticated (Admin+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

4.4 Medium Affected All – 1.8.9 Patched in ✓ 1.9.0 Published 4 Sep 2024 CVE CVE-2024-8618

PageLayer <= 1.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The PageLayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts multi-site installations and installations where unfiltered_html has been disabled. CVE-2024-8426 may be a duplicate of this issue.

4.4 Medium Affected All – 1.8.7 Patched in ✓ 1.8.8 Published 28 Aug 2024 CVE CVE-2024-43972

Page Builder: Pagelayer <= 1.8.7 - Authenticated (Admin+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

4.4 Medium Affected All – 1.8.7 Patched in ✓ 1.8.8 Published 28 Jul 2024 CVE CVE-2024-8426

PageLayer <= 1.8.1 - Missing Authorization

CWE-862 · Missing Authorization

The PageLayer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the pagelayer_trash_post() function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary posts.

4.3 Medium Affected All – 1.8.1 Patched in ✓ 1.8.2 Published 28 Mar 2024 CVE CVE-2024-30465

Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'attr' parameter in all versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 1.8.4 Patched in ✓ 1.8.5 Published 21 Mar 2024 CVE CVE-2024-2504

Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom attributes in all versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 1.8.3 Patched in ✓ 1.8.4 Published 7 Mar 2024 CVE CVE-2024-2127

Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Widget in all versions up to, and including, 1.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

4.6 Medium Affected All – 1.8.2 Patched in ✓ 1.8.3 Published 22 Feb 2024 CVE CVE-2024-1590

Pagelayer <= 1.7.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via Header/Footer code

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Page Builder: Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via header/footer code in all versions up to and including 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

4.4 Medium Affected All – 1.8.0 Patched in ✓ 1.8.0 Published 31 Jan 2024 CVE CVE-2023-5124

PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields

CWE-20 · Improper Input Validation

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagelayer_header_code', 'pagelayer_body_open_code', and 'pagelayer_footer_code' meta fields in all versions up to, and including, 1.7.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This appears to be a reintroduction of a vulnerability patched in version 1.7.7.

5.4 Medium Affected All – 1.7.8 Patched in ✓ 1.7.9 Published 3 Jan 2024 CVE CVE-2023-6738

Page Builder: Pagelayer <= 1.7.9 - Authenticated (Admin+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

4.4 Medium Affected All – 1.7.9 Patched in ✓ 1.8.1 Published 24 Dec 2023 CVE CVE-2023-7115

PageLayer <= 1.7.7 - Cross-Site Request Forgery via pagelayer_load_plugin

CWE-862 · Missing Authorization

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.7. This is due to missing or incorrect nonce validation on the pagelayer_load_plugin function. This makes it possible for unauthenticated attackers to disable the "getting started" promo via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

5.3 Medium Affected All – 1.7.7 Patched in ✓ 1.7.8 Published 1 Dec 2023 CVE CVE-2023-49196

Page Builder: Pagelayer – Drag and Drop website builder <= 1.7.6 - Missing Authorization to Stored Cross-Site Scripting

CWE-862 · Missing Authorization

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pagelayer_save_post() function in all versions up to, and including, 1.7.6. This makes it possible for unauthenticated attackers to inject malicious JavaScript in the header/footer of scheduled posts which may execute whenever a user accesses the injected page/post.

7.2 High Affected All – 1.7.6 Patched in ✓ 1.7.7 Published 25 Sep 2023 CVE CVE-2023-4687

Page Builder: Pagelayer <= 1.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via Header/Footer

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via header/footer post content in all versions up to, and including, 1.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 1.7.7 Patched in ✓ 1.7.8 Published 25 Sep 2023 CVE CVE-2023-5087

PageLayer <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The PageLayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ pagelayer_header_code’, 'pagelayer_body_code', and 'pagelayer_footer_code' parameters in versions up to, and including, 1.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 1.7.7 Patched in ✓ 1.7.7 Published 13 Sep 2023

Page Builder: Pagelayer – Drag and Drop website builder < 1.3.5 - Reflected Cross-Site Scripting via font-size

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

PageLayer before 1.3.5 allows reflected XSS via the font-size parameter.

6.1 Medium Affected All – 1.3.5 Patched in ✓ 1.3.5 Published 10 Dec 2020 CVE CVE-2020-36383

Page Builder: Pagelayer – Drag and Drop website builder < 1.3.5 - Reflected Cross-Site Scripting via Color Settings

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

PageLayer before 1.3.5 allows reflected XSS via color settings.

6.1 Medium Affected All – 1.3.5 Patched in ✓ 1.3.5 Published 10 Dec 2020 CVE CVE-2020-36384

Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Cross-Site Request Forgery to Cross-Site Scripting

CWE-352 · Cross-Site Request Forgery (CSRF)

An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vulnerable to CSRF, which can lead to XSS.

8.8 High Affected All – 1.1.2 Patched in ✓ 1.1.2 Published 28 May 2020 CVE CVE-2020-35944

Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Missing Authorization to Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks, allowing these actions to be executed by anyone authenticated on the site. This happened because nonces were used as a means of authorization, but a nonce was present in a publicly viewable page. The greatest impact was the pagelayer_save_content function that allowed pages to be modified and allowed XSS to occur.

7.4 High Affected All – 1.1.2 Patched in ✓ 1.1.2 Published 28 May 2020 CVE CVE-2020-35947

About Page Builder: Pagelayer

The most advanced frontend drag & drop page builder. Pagelayer is a light weight but extremely powerful Website Builder.

Presenting you Pagelayer a WordPress Website builder. Whether you’re a beginner or a professional, Pagelayer is built for delivering the best designing experience and fast performance that you will fall in love with.

Pagelayer is an awesome page builder that allows you to create and design your website instantly in the simplest way possible. Take control over your page content with the most advanced page builder plugin available. With Pagelayer, you can create just about everything !

Home Page | Support | Documents

Gutenberg Editor Blocks Integration

Pagelayer smoothly collaborates with the Gutenberg editor, ensuring it aligns seamlessly with WordPress’ built-in block editor. This means you can effortlessly blend Pagelayer’s advanced page-building tools with the user-friendly Gutenberg blocks, giving you the best of both worlds. Whether you fancy the straightforwardness of Gutenberg blocks or the sophistication of Pagelayer’s drag-and-drop editor, the decision is entirely yours. This compatibility grants you the flexibility to harness the strengths of both systems, resulting in unmatched design versatility for your WordPress website. Explore the synergy of Pagelayer and Gutenberg, unlocking a new level of creativity for your web projects.

Next generation Drag & Drop Editor

Now making your imagined website designs is as simple as just a few drag and drop made possible only with Pagelayer. A next-generation page builder with so many features and functionality and as easy as a piece of cake without the need of technical knowledge.

Widgets for every design

Thinking if the design in your mind is possible 🤔? Yes! it is now possible with Pagelayer. We have a large number of widgets (100+) to choose and design from, be it a blog, portfolio, corporate, e-commerce or any other category. With Pagelayer everything is possible. To learn about widgets visit here.

Stunning Experience with Real-Time Design

Designing is no fun if we have to refresh the page to see the changes being applied😥. Say no to reloads. Pagelayer builder is a real-time builder so whenever you make changes on your page it gets updated instantly on the preview in the editor so you can check how the changes look. It helps you design your page quickly by saving your time.
No more disjointed experience, build and edit everything right in front of your eyes.

E-Commerce website designing

Turn your website into an eCommerce machine with innovative tools and widgets to create an online shopping experience: product catalogs, product pages or shopping carts.

Advanced In-line Editing

Experience the all-new PEN editor a next-generation text editor. Simply click on any text and start typing edit the existing text or add your custom text. A variety of header and text options enhance your experience as well.

Responsiveness for all device

With Pagelayer responsive design is now made easy no coding, no hassle just a few tweaks and your website is ready to render as per your desired setting on any kind of device. Manage responsiveness for typography, color, padding, and all settings for tablet and mobile.

Cloning made easy

Now save time by just a click of a mouse, need to clone a section? or a page? or a post? no worries Pagelayer got you covered. Leave duplicating to Pagelayer the all-new advanced real-time builder.

30+ Free Widgets and adding more

Row
Columns
Title
Rich Text
Quote
List
Icon
Badge
Tooltip
Image
Image Slider
Video
Grid Gallery
Button
Tabs
Accordion
Collapse
Image Box
Icon Box
Space
Embed
Shortcodes
Counter
Google Maps
Testimonial
Progress Bars
Color Block
Alert
Divider
Social Profile
Star Rating
Anchor
And counting…

Unlock the BEST with Pagelayer PREMIUM

The most powerful and professional website builder unlocks the beast with pro [features]{https://pagelayer.com/features/} that will improve your website performance and designing experience to the next level. Get access to more professional widgets, options, and tools to get recognized.

** There are many features to improve your website **
* Sticky header
* Motion Effects
* Mega Menu
* Infinite Scroll
* Call to Action
* Contact Form
* Image Hotspot
* Table
* Modal
* Popup Builder
* TimeLine
* Slides
* List of Premium widgets
* Adding More…

Screenshots

Drag & Drop widgets from the left panel and edit them easily.

Mega Menu is now easy and hassle-free without extra plugin installation.

Resize Control makes perfect pixel designing even easier and more peaceful.

Shapes divider is now the new trend, and with Pagelayer choose from 100+ possibilities.

Motion Effect make your website look cooler with various types of effects.

Responsive designing just got better make your website pixel perfect on all types of device available.

E-Commerce website is now easier to edit and update as per your choice, no more default designs!.

A to Z custom design no more sluggish template, get 100% control on all templates.

Content Slides can be designed without the effort of installing extra plugins.

Changelog

2.1.8 (August 17, 2026)

[Bug-Fix] Enhanced security checks to improve overall stability and protection.

2.1.7 (August 6, 2026)

[Feature] Added PageLayer MCP (Beta) feature.
[Bug-Fix] Added an XSS warning notice while editing posts and pages, and enhanced security checks.

2.1.6 (July 31, 2026)

[Bug-Fix] Enhanced security checks to improve overall stability and protection.

2.1.5 (July 28, 2026)

[Bug-Fix] Enhanced security checks to improve overall stability and protection.

2.1.4 (July 08, 2026)

[Feature] Added Ctrl + K shortcut for widget search.
[Improvement] Improved the builder UI/UX.
[Bug-Fix] There was some PHP warnings. This is fixed.

2.1.3 (June 24, 2026)

[pro-Feature] Added a Markdown widget.
[Bug Fix] Fixed a minor UI issue in the Theme Templates table.

2.1.2 (June 09, 2026)

[Task] Updated version to 2.1.2 due to WordPress API update issue.

2.1.1 (June 09, 2026)

[Improvement] Plugin settings UI updated.
[Bug Fix] Fixed some warnings with PHP 8.2+.
[Task] Tested with WordPress 7.0

2.1.0 (April 09, 2026)

[Bug Fix] Improved XSS security checks.
[Bug Fix] Inline editor has been further improved.

2.0.9 (March 09, 2026)

[Bug Fix] Improved XSS security checks.
[Bug-Fix] There was some PHP warnings. This is fixed.

2.0.8 (FEB 16, 2026)

[Bug Fix] Improved XSS security checks.
[Bug Fix] Sanitized the contact form “Reply-To” header to prevent CRLF injection.
[Bug Fix] Restricted low-level users from adding custom templates in the contact form.

2.0.7 (DEC 02, 2025)

[Task] Tested compatibility with WordPress 6.9.
[Bug-Fix] In some cases, after adding the templates widget, the page/post data in the PageLayer editor was not saved properly. This is fixed.
[Bug-Fix] There was some PHP warnings. This is fixed.
[Bug-Fix] Mobile breakpoints increased to 480px.

2.0.6 (Oct 31, 2025)

[Bug-Fix] Improved user-level security checks in the media replacement feature.

2.0.5 (Oct 23, 2025)

[Bug-Fix] In some cases, in-line editor selection was not working. This is fixed.
[Bug-Fix] There was some PHP warnings. This is fixed.
[Bug-Fix] In some cases, template import was not working properly. This is fixed.

2.0.4 (Sep 03, 2025)

[Task] Added code for new AI functions.

2.0.3 (Jul 29, 2025)

[Task] AI functions compatibility.

2.0.2 (Jul 18, 2025)

[Improvement] Copy paste in editor has been further improved.
[Bug-Fix] In certain cases, Gutenberg editor was not loaded properly. This is fixed.

2.0.1 (May 19, 2025)

[Security-Fix] URLs were not sanitized in some places. This has been fixed!
[Bug-Fix] Font list not showing properly when setting global font to customized. This is fixed.
[Bug-Fix] Nested accordion and collapse widgets were not working properly. This is fixed.

2.0.0 (March 10, 2025)

[Security-Fix] The contributor level validations issue reported by security researcher Brian Sans-Souci (liardom) has been fixed. Please upgrade to this version as soon as possible!

1.9.9 (March 06, 2025)

[Security-Fix] The XSS checks has been further improved. Please upgrade to this version as soon as possible!

1.9.8 (Fab 18, 2025)

[Bug-Fix] There was some PHP version incompatibility from the previous version. This is fixes.

1.9.7 (Fab 14, 2025)

[Security-Fix] The XSS checks has been further improved. Please upgrade to this version as soon as possible!
[Added] Added anchor ID for tab in Tabs widget.
[Bug-Fix] Added x twitter icon in social, social share widgets.
[Bug-Fix] In some cases, post offset was not working properly in the post widget. This is fixed.
[Bug-Fix] Form validation was not working properly when using reCAPTCHA V3 in contact forms. This is fixed.

1.9.6 (Jan 21, 2025)

[Feature] Added Image Mapping widget.
[Feature] Added support for reCAPTCHA V3 in contact form.
[Task] Added x-Twitter icons to Font Awesome icons list.
[Task] The Posts widget has been further improved. You can now select multiple terms to display posts.

1.9.5 (Nov 22, 2024)

[Security-Fix] An XSS vulnerability has been fixed. Please upgrade to this version as soon as possible!
[Bug-fix] In some cases, customizer was not loaded properly. This is fixed.

1.9.4 (Nov 19, 2024)

[Task] Tested compatibility with WordPress 6.7.

1.9.3 (Nov 11, 2024)

[Bug-fix] In some cases, sections were not imported properly in the editor. This is fixed.

1.9.2 (Oct 18, 2024)

[Task] Licensing functionality has been further improved.

1.9.1 (Sep 19, 2024)

[Bug-fix] Readme.txt had the old version. Hence launching a new version with correct number.

1.9.0 (Sep 19, 2024)

[Bug-fix] Improved sanitization of input for some settings.

1.8.9 (Sep 11, 2024)

[Task] Import templates functionality has been further improved.

1.8.8 (Aug 13, 2024)

[Bug-fix] The Google API key was not sanitized properly. This is fixed.
[Bug-fix] There was some PHP warnings. This is fixed.

1.8.7 (Jul 25, 2024)

[Bug-fix] In some cases Pagelayer auto installer was not working properly. This is fixed.

1.8.6 (Jul 16, 2024)

[Task] Tested compatibility with WordPress 6.5 and made required changes.
[Bug-fix] The widget child selector in the Pagelayer Editor has been further improved.

1.8.5 (March 19, 2024)

[Security-Fix] An XSS vulnerability has been fixed. Please upgrade to this version as soon as possible!

1.8.4 (March 05, 2024)

[Security-Fix] An XSS vulnerability has been fixed. Please upgrade to this version as soon as possible!
[Bug-fix] In certain cases, the modal content was not aligned properly. This is fixed.
[Bug-fix] In certain cases, the slider height was not set correctly. This is fixed.

1.8.3 (Feb 22, 2024)

[Security-Fix] An XSS vulnerability has been fixed. Please upgrade to this version as soon as possible!
[Bug-fix] There was some PHP warnings. This is fixed.

1.8.2 (Jan 23, 2024)

[Security-Fix] The security check for “Move to trash” from pagelayer editor has been further improved.
[Bug-fix] In some cases in Gutenberg, slider blocks were broken during move child. This is fixed.
[Bug-fix] In some cases, the content of the previous post was loaded when adding a new page. This is fixed.
[Bug-fix] In some cases, the video and facebook blocks were not working properly. This is fixed.

1.8.1 (Jan 09, 2024)

[Feature] Added support for all Pagelayer widgets in Gutenberg, you can now use Pagelayer widgets in the Gutenberg editor.
[Bug-fix] In the Pagelayer -> Settings and Pagelayer -> Website Settings, certain settings were not escaped and sanitized. This is fixed.

1.8.0 (Dec 25, 2023)

[Bug-fix] In some cases Pagelayer was causing a PHP error due to the screen function returning null. This is fixed.

1.7.9 (Dec 25, 2023)

[Security-Fix] An XSS vulnerability has been fixed. Please upgrade to this version as soon as possible!
[Task] Tested compatibility with WordPress 6.4 and made required changes.

1.7.8 (Sep 22, 2023)

[Security-Fix] An XSS and scheduled post vulnerabilities have been further improved. Please upgrade to this version as soon as possible!

1.7.7 (Sep 13, 2023)

[Security-Fix] An XSS and scheduled post vulnerability was found. This is fixed. Please upgrade to this version ASAP !
[Improvement] The “Edit with Pagelayer” button UI on Gutenberg and Classic Editor has been further improved.
[Bug-fix] Pagelayer getting started notice could be dismissed by unauthorized users. This is fixed.

1.7.6 (July 12, 2023)

[Bug-fix] In some cases, the row editing options were hidden at the top when the first row was at the top. This is fixed.
[Bug-fix] The global fonts and global colors were not working properly with block theme. This is fixed.
[Bug-fix] In some cases, the export feature was not working properly. This is fixed.
[Bug-fix] Twitter share was not working properly in social share widget. This is fixed.
[Bug-fix] Breadcrumb widget has been improved to display the parent of the page. This is fixed.
[Bug-fix] On turning on the error report in PHP, some PHP error notice was shown. This is fixed.

1.7.5 (May 11, 2023)

[Bug-fix] Made Pagelayer compatible with block themes.

1.7.4 (April 03, 2023)

[Feature] Added “before after image” widget.
[Feature] Added “Get-Pocket” and “TikTok” icons to the social profile widget.
[Feature] Also added “Get-Pocket” and “Email” icons to the social share widget.
[Bug-fix] There were some PHP warnings in Customizer. This is fixed.
[Bug-fix] In some cases, the contact form with multi-checkbox did not work properly. This is fixed.

1.7.3 (Feb 02, 2023)

[Feature] Added setting to load Google Fonts locally on the Pagelayer -> Settings page. Now if you do not want to load Google fonts directly from Google API then you can enable this setting to load Google fonts from your local server.
[Bug-Fix] In certain cases, some WooCommerce widgets were not rendering properly. This is fixed.
[Bug-Fix] In certain cases, the video URLs were not created correctly. This is fixed.
[Bug-Fix] In certain cases, google fonts were not loaded properly. This is fixed.

1.7.2 (Nov 04, 2022)

[Feature] Added setting to add content when body is open on Pagelayer -> website settings page.
[Task] Allow to add otf extension font files to Pagelayer custom font.
[Bug-Fix] On turning on the error report in PHP, some PHP error notice was shown. This is fixed.
[Bug Fix] The post guid was not updated properly when cloning the post. This is fixed.
[Bug Fix] In certain cases scripts were not loaded properly in the Pagelayer editor. This is fixed.

1.7.1 (Sep 07, 2022)

[Feature] Added Customizer settings for WooCommerce. Now you can easily customize your WooCommerce Store.

1.7.0 (July 28, 2022)

[Task] The typography properties has been further improved.
[Task] Added global color option for the gradient property.
[Task] Added the “HTML Tag” option in post title widget. Now you can select the tags to wrap the post title.
[Bug-Fix] In the some widgets global colors were not applied properly. This is fixed.
[Bug-Fix] In some cases Ctrl+Z was not working properly. This is fixed.
[Bug-Fix] In the Social Icon widget, icons were aligning with respect to the holder. This is fixed.

1.6.9 (June 02, 2022)

[Bug-Fix] After the previous version, in some cases, the add section was not working properly. This is fixed.

1.6.8 (May 25, 2022)

[Feature] Added Customizer settings to set global styles for elements. Also you can set different global styles for each post type.
[Feature] Added Global Color and Typography palette in customizer. Now you can set Global Color and Typography for each element.
[Feature] The Global color and typography properties have been added to the Pagelayer Editor as well. Now you can set global color and typography from the dropdown list.
[Bug-Fix] Textarea typography was not applied properly in the Contact Form widget. This is fixed.
[Bug-Fix] In certain cases, the add section was not working properly. This is fixed.
[Bug-Fix] In certain cases, the google fonts was not working properly. This is fixed.

1.6.7 (April 07, 2022)

[Bug-Fix] In some cases, the onload content animation was not working properly. This is fixed.
[Bug-Fix] In some cases, the CSS was not applied properly for the tablet and mobile devices. This is fixed.
[Bug-Fix] In some cases, sticky elements styles were not applied properly. This is fixed.

1.6.6 (March 09, 2022)

[Task] The editing experience within Pagelayer editor has been further improved. Now users can move from one widget to another with the help of up and down arrow keys. We are trying to make the editor into a more user friendly document editor.
[Task] Now we will add a text widget after the active widget when enter is pressed. You can add a slash “/” to search and convert the widget.

1.6.5 (Feb 21, 2022)

[Task] The Pagelayer pen editor UX has been further improved.
[Bug-Fix] In some cases, the font-family and other css of icons were not applied correctly after the previous version. This is fixed.
[Bug-Fix] In some cases, Pagelayer import was not working properly. This is fixed.
[Bug-Fix] In some cases, Youtube video autoplay was not working. This is fixed.

1.6.4 (Feb 11, 2022)

[Task] WordPress 5.9 adds support for capability queries in WP_User_Query. We have tested and made required changes.
[Bug-Fix] In certain cases, some style was not applied properly in the editor. This is fixed.
[Bug-Fix] In the primary menu widget, after the menu item title was changed, the menu title was not updated. This is fixed.

1.6.3 (Jan 31, 2022)

[Bug-Fix] In certain cases, the primary menu widget was not rendering properly. This is fixed.
[Bug-Fix] In certain cases, the posts widget slider was not working properly. This is fixed.

1.6.2 (Jan 29, 2022)

[Task] The Pagelayer introduction video link has been updated.

1.6.1 (Jan 25, 2022)

[Task] Pagelayer has been tested with WordPress 5.9.
[Bug-Fix] In the vertical primary menu, mega menu position was not working properly. This is fixed.

1.6.0 (Jan 03, 2022)

[Feature] Added mega menu option in the primary menu widget. Now users can create a mega menu with the help of Pagelayer drag and drop feature.
[Improvement] Slides widget has been further improved as a content slider. Now users can design the slides with the help of Pagelayer drag and drop feature.
[Improvement] Added the infinite scroll and alternative alignment options for the posts and archive posts widgets.
[Task] The Font-Awesome 5 library has been updated.
[Task] The primary menu widget has been further improved. And also added sub-menu animation option.
[Task] Added more options for customizing slider(s) dots and arrows.
[Bug-Fix] In certain cases, the table widget height was not working properly. This is fixed.
[Bug-Fix] In the editor the some JS files were not cached. This is fixed.
[Bug-Fix] In certain cases, the login widget was not working properly. This is fixed.
[Bug-Fix] In certain cases, the button group widget font size not working properly. This is fixed.
[Bug-Fix] In certain cases, the rotating text in the animated heading widget came on next line. This is fixed.
[Bug-Fix] At times, if there was a div tag in the rich text editor, an undefined error used to be thrown. This is fixed.

1.5.9 (Nov 03, 2021)

[Bug-Fix] On turning on the error report in PHP, some PHP error notice was shown. This is fixed.
[Bug-Fix] In certain cases, inline editing in table widget was not working properly. This is fixed.

1.5.8 (Oct 20, 2021)

[Improvement] The link property has been further improved to add target, rel and other attributes.
[Improvement] Added the color options in the social share widget for the labels.
[Improvement] Added alignment option in Pricing table widget and also added screen mode option where needed.
[Task] The list of Google fonts has been updated.
[Bug-Fix] In some cases, the JS/CSS files compressor was not loaded properly. This is fixed and also added option in Pagelayer setting to enable/disable JS/CSS giver.
[Bug-Fix] In the social share widget the “Open link in new window” was not working properly. This is fixed.
[Bug-Fix] In some cases, the Custom Attributes option was not working properly. This is fixed.
[Bug-Fix] In the Audio widget the time handler height was not set properly. This is fixed.
[Bug-Fix] In the options section the font family property was not working properly. This is fixed.

1.5.7 (Sep 28, 2021)

[Bug-Fix] In some cases, the widget dropdown list was not hiding properly. This is fixed.

1.5.6 (Sep 18, 2021)

[Bug-Fix] In some cases, the position of the widget dropdown list was not correct. This is fixed.

1.5.5 (Sep 16, 2021)

[Improvement] The Title Widget has been further improved. Now users can search for widgets with a slash (/) and replace the selected widget with the current widget and also added the plus icon near the bottom of all widgets to add widget after the current widget.
[Improvement] Login widget has been further improved.
[Improvement] Insert link option UI of our pen editor has been further improved.
[Bug-Fix] In certain cases the Pagelayer pen heading and paragraph formatting was not working properly. This is fixed.
[Bug-Fix] The Roboto font within the system section was not working. We have removed the system font option of Roboto and left the Google Font option. This is fixed.
[Bug-Fix] In certain cases the background video was not working properly. This is fixed.
[Bug-Fix] When the dropdown menu was set to in tablet or mobile mode, the full primary menu was shown when reloading the page. This is fixed.
[Bug-Fix] In some cases, the pen editor’s unlink option was not working properly. This is fixed.

1.5.4 (Aug 05, 2021)

[Improvement] The Inline editor position has been further improved for the better user experience.
[Improvement] Added system fonts to Typography font list.
[Bug-Fix] While using Pagelayer template the WordPress Page Break was not working properly. This is fixed.
[Bug-Fix] The linked media file was the thumbnail image if image size thumbnail was selected in the Image slider widget. This is fixed.
[Bug-Fix] In some cases the review widget was not working properly when editing inline. This is fixed.
[Bug-Fix] Post status used to be changed to draft when updating Pagelayer popup template via Pagelayer editor. This is fixed.
[Bug-Fix] In certain cases the inline editor font family was not working properly. This is fixed.
[Bug-Fix] The blank post excerpt was not updated properly. This is fixed.
[Bug-Fix] In some cases, page scroll was added because of the width of the table. This is fixed.
[Bug-Fix] After adding the link, the inline editor was unable to edit the image and icon box contents. This is fixed.

1.5.3 (July 28, 2021)

[Bug-Fix] In some cases there was some js error occurred after the last version. This is fixed.

1.5.2 (July 23, 2021)

[Feature] We have improved the inline editor UI and UX. This is to give a better experience while editing the text. More improvements to the editing experience will follow soon.
[Feature] Retina Image option enabled for Image and Image Box widgets.
[Feature] Added option for custom thumbnail in posts and archive posts widgets.
[Feature] The Map widget has been further improved for Google map v3. We recommend you use version 3 as Google is deprecating version 2, or Google may discontinue version 2 maps at any time.
[Feature] Added Enter and Backspace key handler, now on press enter key inside title widget, we will break widget content from current cursor position and open new title widget with same content and by clicking backspace we will merge it again.
[Improvement] Added col margin option in the posts and archive posts widget.
[Improvement] Added space between option in image slider widget.
[Improvement] Added the “download file name” option to the download button widget. Now user can set the custom name of the download file.
[Improvement] Added alignment, size and max width options for the Row and Column parallax image.
[Improvement] Image drop zone UI has been further fixed.
[Improvement] Added alt and title attributes for the site logo and post author image.
[Bug-Fix] The image media modal headings styles have been further fixed.
[Bug-Fix] In the image hotspot, quote and list widgets, the icon styles were applied for all the I (italics) tag. This is fixed.
[Bug-Fix] When editing the tooltip text through the inline editor, the tooltip was hidden when hovered out. This is fixed.
[Bug-Fix] In certain case while resizing the window, the primary menu was not working properly. This is fixed.
[Bug-Fix] While adding Tab widget inside the Tab widget, the Tab widgets were not working properly. This is fixed.
[Bug-Fix] Clicking on the close alert icon in the editor will hide the alert widget. Due to this we were not able to edit the alert widget again. This is fixed.
[Bug-Fix] While editing the slider content through the inline editor, we were unable to select content. This is fixed.
[Bug-Fix] On window resizing the scroll effects was not working properly. This is fixed.
[Bug-Fix] While pasting the content, the widgets were pasted. This is fixed.
[Bug-Fix] In certain cases, the video widget was not working properly. This is fixed.
[Bug-Fix] In certain cases, the video mute option was not working properly. This is fixed.
[Bug-Fix] Post widget copy-paste and duplicate was not working properly. This is fixed.
[Bug-Fix] In certain cases, the audio widget was not working properly. This is fixed.

1.5.1 (May 18, 2021)

[Bug-Fix] Some images were not imported properly while importing the theme if the same slug was used. This is fixed.
[Bug-Fix] Icon alignment on contact form submit button was not working properly. This is fixed.
[Bug-Fix] After the last update contact form custom template settings were not applied properly. This is fixed.
[Bug-Fix] In certain cases some js error occurred when the post content was empty. This is fixed.
[Bug-Fix] The border radius on the hover of the countdown timer widget was not working properly. This is fixed.

Alternatives to Page Builder: Pagelayer

Other WordPress plugins serving a similar purpose, ranked by relevance and PF Score.

Platinum96.2