The WPBakery Page Builder plugin, a widely used tool for creating and managing content on WordPress websites, has been found to have a security flaw. This vulnerability, identified as a Stored Cross-Site Scripting (XSS) issue, could allow attackers to inject malicious code into your website.<\/p>\n
This particular problem stems from how the plugin handles user-provided information within its ‘rev_slider_vc’ shortcode. Simply put, it wasn’t careful enough in checking and cleaning up this input. This means that if an attacker, who has at least contributor-level access to your WordPress site, inserts harmful scripts into pages, those scripts will run every time someone visits an affected page. It’s important to note that this specific vulnerability can only be exploited if the Revolution Slider plugin is also installed on your WordPress site.<\/p>\n
Product:<\/strong> WPBakery Page Builder plugin for WordPress The vulnerability impacts the WPBakery Page Builder plugin for WordPress in all versions up to, and including, 8.6. Users running these older versions are at risk if they also have Revolution Slider installed and allow contributor-level users to create or edit content.<\/p>\n This vulnerability has been thoroughly analyzed. Information regarding its nature and potential impact is available, and fixes have been released by the vendor.<\/p>\n The vulnerability has been assigned a CVSS score of 6.4, classifying it as a Medium<\/strong> severity issue. A medium severity rating indicates that while the vulnerability is a concern and should be addressed, it typically requires specific conditions or user interaction to be exploited, and its impact might be limited compared to critical flaws. In this case, an attacker needs at least contributor-level access and the presence of another specific plugin (Revolution Slider) for the exploit to work.<\/p>\n The good news is that WPBakery has addressed this issue. To protect your website from CVE-2025-10006, the most effective solution is to update your WPBakery Page Builder plugin immediately. Specifically, this vulnerability was resolved in WPBakery Page Builder version 8.7<\/strong>, released on October 13, 2025, and all subsequent versions. If you are running an older version, updating to 8.7 or newer will patch this security hole.<\/p>\n If you cannot update immediately, consider these mitigation steps:<\/p>\n https:\/\/kb.wpbakery.com\/docs\/preface\/release-notes\/ The WPBakery Page Builder plugin, a widely used tool for creating and managing content on WordPress websites, has been found to have a security flaw. This vulnerability, identified<\/p>\n","protected":false},"author":17,"featured_media":2545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1304,789,726,1303,692],"class_list":["post-4208","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-page-builder","tag-security","tag-wordpress","tag-wpbakery","tag-xss"],"yoast_head":"\n
\nPublished:<\/strong> October 18, 2025
\nSeverity:<\/strong> Medium
\nStatus:<\/strong> Analyzed<\/p>\nAffected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n
\nhttps:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/4d7b12e5-0de7-45f4-84e0-083818912623?source=cve<\/p>\n","protected":false},"excerpt":{"rendered":"