The WPBakery Page Builder plugin, a widely used tool for crafting stunning WordPress websites, has been found to have a security flaw. This vulnerability, identified as CVE-2025-11161, could allow malicious actors to inject harmful scripts into your website, potentially compromising user data or defacing your site.<\/p>\n
This vulnerability affects the WPBakery Page Builder plugin for WordPress. It was officially published on October 15, 2025, and is currently under “Analyzed” status. The severity level is rated as Medium.<\/p>\n
The Stored Cross-Site Scripting (XSS) vulnerability impacts all versions of the WPBakery Page Builder plugin up to, and including, 8.6.1. Specifically, the issue stems from inadequate restrictions on allowed HTML tags and improper cleaning of user-provided information within the The vulnerability status is “Analyzed,” meaning the details have been thoroughly reviewed and confirmed.<\/p>\n This vulnerability has been assigned a Medium severity level with a CVSS score of 6.4. While it requires an authenticated attacker with specific access, the potential for injected scripts to impact website visitors makes it a concern that should be addressed promptly.<\/p>\n To protect your WordPress site from this Stored Cross-Site Scripting vulnerability, it is crucial to update your WPBakery Page Builder plugin immediately. Based on the release notes, WPBakery Page Builder version 8.7, released on October 13, 2025, includes fixes for “encoded shortcodes” and general “sanitization before saving user input” as well as overall “security improvements for the Backend editor”. These updates collectively address the underlying issues that led to this vulnerability. Therefore, users should update their WPBakery Page Builder plugin to **version 8.7 or later** to ensure their sites are secure. Always back up your website before performing any updates.<\/p>\n https:\/\/kb.wpbakery.com\/docs\/preface\/release-notes\/ The WPBakery Page Builder plugin, a widely used tool for crafting stunning WordPress websites, has been found to have a security flaw. This vulnerability, identified as CVE-2025-11161, could<\/p>\n","protected":false},"author":17,"featured_media":2545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[715,709,719,1298,759],"class_list":["post-4184","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-plugin-vulnerability","tag-web-application-security","tag-wordpress-security","tag-wpbakery-page-builder","tag-xss-vulnerability"],"yoast_head":"\nfont_container<\/code> parameter of the vc_custom_heading<\/code> shortcode. This oversight could enable authenticated attackers, even those with basic contributor-level access, to insert malicious web scripts into posts. These scripts would then run whenever a user views a page containing the injected content.<\/p>\nCurrent Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
References<\/h2>\n
https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/2772cade-c625-437a-b57b-ce8a2e3393bf?source=cve<\/p>\n","protected":false},"excerpt":{"rendered":"