CVE-2025-11160: The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module…
CVE-2025-11160 · Severity: medium · CVSS 6.4 · Published 2025-10-15
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1. This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS module. This makes it possible for authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the WPBakery Page Builder Custom JS module granted they have access to the WPBakery editor for post types.
No. Junglewise Threat Intelligence has no report of CVE-2025-11160 being exploited in the wild.
How severe is CVE-2025-11160?
Medium severity, with a CVSS score of 6.4, published 15 October 2025.
Which products and versions are affected?
WPBakery Page Builder. The advisory does not name versions.
Is there a fix for CVE-2025-11160?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2025-11160?
Check whether you run WPBakery Page Builder. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.