Executive brief
WPBakery Page Builder is a popular drag-and-drop page creation plugin for WordPress websites. The plugin fails to properly sanitize user input in the 'data' parameter, allowing authenticated users with subscriber access or higher to inject malicious scripts into pages. When other users visit the compromised pages, these scripts execute in their browsers, potentially compromising accounts, stealing data, or performing unauthorized actions on behalf of the victim.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in WPBakery Page Builder affecting versions up to 8.7.4. The root cause is insufficient input validation: attackers can bypass the wp_kses_post sanitization by base64-encoding their XSS payload as plain alphanumeric text without HTML tags, which passes the sanitization check. At render time, the vc_raw_html shortcode template decodes and outputs this content without escaping, allowing the injected script to execute. The vulnerability requires authenticated access at subscriber level or above but affects any user viewing the injected page. A patch is available in versions after 8.7.4.
Affected products
- Elegant Themes WPBakery Page Builder up to 8.7.4
Timeline
- 2026-09-01: disclosed
- 2026-09-01: advisory: CVE-2026-15101 published on NVD