The WC Builder – WooCommerce Page Builder for WPBakery plugin contains a stored cross‑site scripting flaw that occurs when the heading_color parameter, along with other styling options, is inserted into the wpbforwpbakery_product_additional_information shortcode. Because the plugin does not sanitize or escape the data before persisting it, an attacker can embed arbitrary JavaScript that will run in the browsers of any site visitor. This allows a Shop Manager‑level user or higher to compromise the confidentiality and integrity of the site, potentially hijack sessions, or deface content in a way that is invisible to the default WordPress security tools. The flaw is a classic example of CWE‑79.

The vulnerability exists in the hasthemes: WC Builder – WooCommerce Page Builder for WPBakery plugin for WordPress. All releases up to and including version 1.2.0 are impacted. Site owners should confirm they are running a version newer than 1.2.0 or have applied the vendor’s fix.

The CVSS score of 4.4 signals moderate severity, while an EPSS score of < 1 % points to a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with Shop Manager or higher privileges, making the attack vector local to the site rather than truly remote; based on the description, the local attack inference is made because the plugin requires such authenticated access, a detail that is logically derived rather than explicitly stated. Once a malicious script is stored, it will execute for every user who views the affected page, creating a widespread risk for all visitors.