Alex Joseph
The WPBakery Page Builder plugin, a widely used tool for creating and managing content on WordPress websites, has been found to have a security flaw. This vulnerability, identified as a Stored Cross-Site Scripting (XSS) issue, could allow attackers to inject malicious code into your website.
This particular problem stems from how the plugin handles user-provided information within its ‘rev_slider_vc’ shortcode. Simply put, it wasn’t careful enough in checking and cleaning up this input. This means that if an attacker, who has at least contributor-level access to your WordPress site, inserts harmful scripts into pages, those scripts will run every time someone visits an affected page. It’s important to note that this specific vulnerability can only be exploited if the Revolution Slider plugin is also installed on your WordPress site.
CVE Details
Product: WPBakery Page Builder plugin for WordPress
Published: October 18, 2025
Severity: Medium
Status: Analyzed
Affected Products
The vulnerability impacts the WPBakery Page Builder plugin for WordPress in all versions up to, and including, 8.6. Users running these older versions are at risk if they also have Revolution Slider installed and allow contributor-level users to create or edit content.
Current Status
This vulnerability has been thoroughly analyzed. Information regarding its nature and potential impact is available, and fixes have been released by the vendor.
Severity Level
The vulnerability has been assigned a CVSS score of 6.4, classifying it as a Medium severity issue. A medium severity rating indicates that while the vulnerability is a concern and should be addressed, it typically requires specific conditions or user interaction to be exploited, and its impact might be limited compared to critical flaws. In this case, an attacker needs at least contributor-level access and the presence of another specific plugin (Revolution Slider) for the exploit to work.
Possible Solutions
The good news is that WPBakery has addressed this issue. To protect your website from CVE-2025-10006, the most effective solution is to update your WPBakery Page Builder plugin immediately. Specifically, this vulnerability was resolved in WPBakery Page Builder version 8.7, released on October 13, 2025, and all subsequent versions. If you are running an older version, updating to 8.7 or newer will patch this security hole.
If you cannot update immediately, consider these mitigation steps:
- Update Revolution Slider: Ensure Revolution Slider is also updated to its latest version, as this vulnerability requires its presence.
- Review User Roles: Limit content creation and editing capabilities to trusted users. Restrict roles like “Contributor” and “Author” from directly inserting unfiltered HTML or JavaScript.
- Implement Strict Input Validation: Although the vendor has released a fix, adopting strong input sanitization and output escaping practices site-wide is always a good security measure.
References
https://kb.wpbakery.com/docs/preface/release-notes/
https://www.wordfence.com/threat-intel/vulnerabilities/id/4d7b12e5-0de7-45f4-84e0-083818912623?source=cve
