Description

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via a forged request that results in Stored Cross-Site Scripting executed in the administrator's session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-12T06:16:25.833Z",
  "pubdate": "2026-09-12T06:16:25.833Z",
  "executiveSummary": "The Export & Import WPBakery Page Builder WordPress plugin, in versions through 1.0.2, is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability coupled with a Stored Cross-Site Scripting (XSS) flaw within its template-import feature.\nThe vulnerability arises from the absence of CSRF validation tokens and improper input sanitization during the template import process. An attacker can exploit this by deceiving an authenticated administrator into executing a malicious request, which subsequently stores and triggers arbitrary JavaScript in the administrative session.\nThis impact allows for unauthorized actions, potential theft of session tokens, and administrative account compromise. Because the payload is stored and executed within the administrator's context, the attacker gains a high-level foothold on the WordPress site. Exploitation requires the attacker to successfully perform a CSRF attack against an active, logged-in administrator, meaning the impact is contingent on social engineering or a malicious trigger within the administrator's browser session. The vulnerability highlights a critical failure in input validation and session security within the plugin's architectural design.",
  "technicalDetails": "The vulnerability is primarily rooted in the plugin's template-import functionality, which fails to implement nonce-based CSRF protection. Without a cryptographically secure token to verify the intent of the request, the application treats forged requests as legitimate commands originating from the administrative user.\nThe attack flow begins when an attacker crafts a malicious template file containing an XSS payload—typically a script block or an event handler—designed to execute in the victim's browser. The attacker then hosts this file or creates a malicious URL that forces the victim's browser to submit the template import request to the plugin's backend.\nUpon receiving the request, the plugin fails to sanitize the imported template data before storing it in the WordPress database. Consequently, the malicious payload is persisted as part of the template configuration. When an administrator navigates to the dashboard or the page builder interface where the template data is rendered, the application echoes the unsanitized input back to the browser.\nBecause the output is rendered without proper escaping, the browser interprets the payload as active content rather than plain text. This results in the execution of the script in the context of the administrator’s session. An attacker can utilize this execution context to perform unauthorized administrative operations, capture session cookies via document.cookie, modify site settings, or redirect the user to malicious external domains.\nAffected versions are strictly those up to and including 1.0.2. The lack of proper input validation (sanitization) is the primary driver of the Stored XSS, while the lack of CSRF tokens is the primary driver of the authorization bypass. This combination allows for a high-impact exploit that bypasses the need for the attacker to possess direct administrative credentials, provided they can trigger the malicious request through an authorized user's session."
}