The WPBakery Page Builder plugin for WordPress is vulnerable to stored Cross‑Site Scripting (CWE‑80) through its Custom JS module. The lack of proper input sanitization and output escaping allows an authenticated contributor or higher to embed arbitrary JavaScript that is persisted and executed on any page that includes the Custom JS module. This could lead to session hijacking, defacement, or the delivery of malicious payloads to site visitors.

WordPress sites running the WPBakery Page Builder plugin, versions 8.6.1 and earlier. The vulnerability affects any installation where the Custom JS module is enabled and users can edit posts, pages, or other editor‑enabled post types.

The CVSS base score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, implying it has not been observed in the wild on a large scale. Exploitation requires authenticated access to the WPBakery editor with contributor or higher privileges, making it an internal threat that could affect any site administrator who grants such permissions. Once the malicious script is inserted it will run for all visitors who load the affected page, making this a potentially broadly impactful risk for compromised sites.