Description

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post sanitization applied during save does not neutralize the payload because the malicious script content is base64-encoded as plain alphanumeric text with no HTML tags to strip; the vc_raw_html shortcode template then decodes and echoes this content unescaped at render time.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-01T10:17:10.253Z",
  "pubdate": "2026-09-01T10:17:10.253Z",
  "executiveSummary": "The WPBakery Page Builder plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, identified in all versions up to and including 8.7.4.\nThe flaw originates from inadequate input sanitization and output escaping mechanisms within the plugin's data handling processes.\nAuthenticated attackers possessing subscriber-level permissions or higher can inject malicious, base64-encoded scripts into page content.\nThese scripts are subsequently decoded and executed within the context of the victim's browser session upon accessing the affected page.\nThe security impact includes potential session hijacking, unauthorized administrative actions, sensitive information disclosure, and full site compromise through malicious script execution.\nExploitation requires authenticated access to the WordPress environment, allowing an attacker with low-level privileges to perform impactful cross-site attacks.",
  "technicalDetails": "The vulnerability resides in the WPBakery Page Builder component responsible for rendering shortcodes, specifically within the handling of the 'data' parameter.\nRoot cause analysis identifies a failure in the input validation logic where the wp_kses_post sanitization function is circumvented.\nAlthough wp_kses_post is employed during the save process, the security mechanism is ineffective because the malicious payload is submitted as base64-encoded plain alphanumeric text.\nBecause the payload lacks traditional HTML tags during the sanitization phase, it bypasses the filtering logic designed to strip dangerous markup.\nThe exploitation flow proceeds as follows: An attacker with subscriber access or higher crafts a malicious payload containing JavaScript, base64-encodes the content, and passes it via the 'data' parameter during a page update or creation.\nThe WordPress database stores this base64-encoded string, which remains inert in storage.\nThe vulnerability is triggered during the rendering phase when the 'vc_raw_html' shortcode template is processed.\nThe 'vc_raw_html' component programmatically decodes the base64-encoded string and subsequently echoes the resulting raw HTML/JavaScript directly into the document object model (DOM) without applying secondary context-aware output encoding or escaping.\nWhen a user, such as an administrator or another subscriber, views the page containing the crafted shortcode, the browser interprets and executes the injected script.\nThis execution occurs within the security context of the victim's session, granting the attacker the ability to perform actions on behalf of the user, steal session cookies, or redirect traffic.\nThe vulnerability affects all versions up to 8.7.4 and necessitates immediate remediation to prevent persistent malicious script execution across the WordPress installation."
}