Is CVE-2026-15101 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15101 being exploited in the wild.

How severe is CVE-2026-15101?

Medium severity, with a CVSS score of 6.4, published 1 September 2026.

Which products and versions are affected?

Elegant Themes WPBakery Page Builder up to 8.7.4.

Is there a fix for CVE-2026-15101?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15101 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15101?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15101: WPBakery Page Builder stored cross-site scripting in data parameter

CVE-2026-15101 · Severity: medium · CVSS 6.4 · Published 2026-09-01

WPBakery Page Builder is a popular drag-and-drop page creation plugin for WordPress websites. The plugin fails to properly sanitize user input in the 'data' parameter, allowing authenticated users with subscriber access or higher to inject malicious scripts into pages. When other users visit the compromised pages, these scripts execute in their browsers, potentially compromising accounts, stealing data, or performing unauthorized actions on behalf of the victim.

Quick answers

Is CVE-2026-15101 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15101 being exploited in the wild.
How severe is CVE-2026-15101?: Medium severity, with a CVSS score of 6.4, published 1 September 2026.
Which products and versions are affected?: Elegant Themes WPBakery Page Builder up to 8.7.4.
Is there a fix for CVE-2026-15101?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15101 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15101?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in WPBakery Page Builder affecting versions up to 8.7.4. The root cause is insufficient input validation: attackers can bypass the wp_kses_post sanitization by base64-encoding their XSS payload as plain alphanumeric text without HTML tags, which passes the sanitization check. At render time, the vc_raw_html shortcode template decodes and outputs this content without escaping, allowing the injected script to execute. The vulnerability requires authenticated access at subscriber level or above but affects any user viewing the injected page. A patch is available in versions after 8.7.4.

Affected products

Elegant Themes WPBakery Page Builder up to 8.7.4

Timeline

2026-09-01: disclosed
2026-09-01: advisory: CVE-2026-15101 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.