Alex Joseph
The WPBakery Page Builder plugin, a widely used tool for crafting stunning WordPress websites, has been found to have a security flaw. This vulnerability, identified as CVE-2025-11161, could allow malicious actors to inject harmful scripts into your website, potentially compromising user data or defacing your site.
CVE Details
This vulnerability affects the WPBakery Page Builder plugin for WordPress. It was officially published on October 15, 2025, and is currently under “Analyzed” status. The severity level is rated as Medium.
Affected Products
The Stored Cross-Site Scripting (XSS) vulnerability impacts all versions of the WPBakery Page Builder plugin up to, and including, 8.6.1. Specifically, the issue stems from inadequate restrictions on allowed HTML tags and improper cleaning of user-provided information within the font_container parameter of the vc_custom_heading shortcode. This oversight could enable authenticated attackers, even those with basic contributor-level access, to insert malicious web scripts into posts. These scripts would then run whenever a user views a page containing the injected content.
Current Status
The vulnerability status is “Analyzed,” meaning the details have been thoroughly reviewed and confirmed.
Severity Level
This vulnerability has been assigned a Medium severity level with a CVSS score of 6.4. While it requires an authenticated attacker with specific access, the potential for injected scripts to impact website visitors makes it a concern that should be addressed promptly.
Possible Solutions
To protect your WordPress site from this Stored Cross-Site Scripting vulnerability, it is crucial to update your WPBakery Page Builder plugin immediately. Based on the release notes, WPBakery Page Builder version 8.7, released on October 13, 2025, includes fixes for “encoded shortcodes” and general “sanitization before saving user input” as well as overall “security improvements for the Backend editor”. These updates collectively address the underlying issues that led to this vulnerability. Therefore, users should update their WPBakery Page Builder plugin to **version 8.7 or later** to ensure their sites are secure. Always back up your website before performing any updates.
References
https://kb.wpbakery.com/docs/preface/release-notes/
https://www.wordfence.com/threat-intel/vulnerabilities/id/2772cade-c625-437a-b57b-ce8a2e3393bf?source=cve
