Alex Joseph
Understanding the WPBakery Page Builder XSS Vulnerability
A security flaw has been found in the WPBakery Page Builder plugin for WordPress, identified as CVE-2025-11160. This vulnerability is a type of Stored Cross-Site Scripting (XSS) and allows malicious scripts to be embedded into websites. If exploited, these scripts can run in a user’s browser, potentially leading to unauthorized actions, information theft, or website defacement.
CVE Details
- Product: WPBakery Page Builder plugin for WordPress
- Published: October 15, 2025
- Severity: Medium
- Status: Analyzed
Affected Products
The vulnerability impacts WPBakery Page Builder plugin for WordPress versions up to, and including, 8.6.1. The flaw resides within the Custom JS module, where the plugin doesn’t properly clean up or “sanitize” user-provided JavaScript code. This oversight creates an opening for authenticated attackers, specifically those with contributor-level access or higher, who have permission to use the WPBakery editor for post types. These attackers can then insert harmful web scripts onto pages, which will execute whenever another user visits those affected pages.
Current Status
This vulnerability has been officially analyzed. This means it has been confirmed and documented by security experts, and its details are publicly available to help users understand the risk and take appropriate protective measures.
Severity Level
Rated as Medium severity, this vulnerability presents a moderate risk. While it requires a certain level of access (contributor or higher) to exploit, a successful attack could still have significant consequences, such as compromising user accounts, altering website content, or redirecting visitors to malicious sites. Timely action is recommended to mitigate potential harm.
Possible Solutions
The most effective way to protect your WordPress site from this Stored Cross-Site Scripting vulnerability is to update your WPBakery Page Builder plugin immediately. According to the release notes, WPBakery Page Builder version 8.7, released on October 13, 2025, addresses various vulnerabilities, including general XSS improvements and specific fixes for encoded shortcodes and RawJS elements. Therefore, users should update to version 8.7 or any later stable release.
Always ensure your WordPress core, themes, and all other plugins are kept up-to-date to benefit from the latest security patches. Furthermore, implement good security practices such as restricting user roles to only the necessary permissions and using a robust security plugin to monitor for suspicious activity.
References
https://kb.wpbakery.com/docs/preface/release-notes/
https://www.wordfence.com/threat-intel/vulnerabilities/id/4c42cc4e-34e7-4f14-b850-7ba5dd2ae099?source=cve
