WPBakery Page Builder contains a stored cross‑site scripting flaw in the vc_custom_heading shortcode that arises from insufficient sanitization of the font_container attribute. The weakness allows an attacker who can edit content to inject malicious JavaScript that runs in the browsers of any visitor who views a page containing the problematic shortcode. This could lead to credential theft, defacement or the execution of further compromised code. The vulnerability is classified as CWE‑80.

The flaw affects the WPBakery Page Builder plugin for WordPress, specifically all versions up to and including 8.6.1. Users running any of those releases with the plugin installed are at risk.

The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests the likelihood of exploitation is currently very low. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated attacker with contributor-level or higher privileges and the ability to add or edit content using the vc_custom_heading shortcode. While the impact is limited to users who view pages edited by the attacker, a misconfigured or broad user role could expand the attack surface.