Wpbakery Page Builder
Monthly
Stored Cross-Site Scripting in WPBakery Page Builder for WordPress (versions through 8.7.4) allows authenticated attackers with subscriber-level access to persistently inject arbitrary JavaScript into pages viewed by any site visitor. The vulnerability stems from a sanitization bypass: the wp_kses_post function strips HTML tags but cannot neutralize base64-encoded payloads - which appear as plain alphanumeric text - and the vc_raw_html shortcode template subsequently decodes and echoes that content without escaping at render time. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the subscriber-level access barrier is low on many WordPress sites that permit open registration.
Broken access control in WPBakery Page Builder (versions ≤ 8.7.2) allows subscriber-level authenticated WordPress users to invoke privileged functionality without proper authorization checks. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms this is network-exploitable with low complexity and high integrity impact, meaning authenticated low-privilege users can perform content or administrative actions restricted to higher roles such as editor or administrator. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but WPBakery Page Builder's broad WordPress deployment footprint makes this a real remediation priority for sites with open user registration.
The WPBakery Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 7.7 due to insufficient input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored Cross-Site Scripting in WPBakery Page Builder for WordPress (versions through 8.7.4) allows authenticated attackers with subscriber-level access to persistently inject arbitrary JavaScript into pages viewed by any site visitor. The vulnerability stems from a sanitization bypass: the wp_kses_post function strips HTML tags but cannot neutralize base64-encoded payloads - which appear as plain alphanumeric text - and the vc_raw_html shortcode template subsequently decodes and echoes that content without escaping at render time. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the subscriber-level access barrier is low on many WordPress sites that permit open registration.
Broken access control in WPBakery Page Builder (versions ≤ 8.7.2) allows subscriber-level authenticated WordPress users to invoke privileged functionality without proper authorization checks. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms this is network-exploitable with low complexity and high integrity impact, meaning authenticated low-privilege users can perform content or administrative actions restricted to higher roles such as editor or administrator. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but WPBakery Page Builder's broad WordPress deployment footprint makes this a real remediation priority for sites with open user registration.
The WPBakery Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 7.7 due to insufficient input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.