CVE-2025-4965

WPBakery Page Builder <= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder

Published Jun 19, 2025 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Builder feature in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

Technical impact

The vulnerability is a stored Cross‑Site Scripting flaw in the Grid Builder feature of WPBakery Page Builder. The plugin fails to sanitize and escape user‑supplied attributes, allowing an authenticated user with author or higher privileges to embed malicious JavaScript into a page. Whenever any visitor loads the compromised page, the injected script executes in their browser, enabling attackers to steal session cookies, deface content, or perform other actions within the context of the logged‑in user.

Affected Systems

Affected are all instances of the WPBakery Page Builder plugin for WordPress version 8.4.1 and earlier. The issue applies to the Grid Builder component in those releases, regardless of the WordPress core version.

Risk and Exploitability

The CVSS base score is 6.4, indicating a moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation at present. It is not listed in the CISA KEV catalog. Attackers must be authenticated at author level or higher, but the resulting cross‑site scripting can affect any user who views the injected page, providing an indirect but potentially wide impact. The correct mitigations are applying a patch or disabling the vulnerable feature.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

wpbakery

WPBakery Page Builder

unaffected

Version	Status	Constraints
`0`	affected	≤ 8.4.1

Configuration 1 [-]

cpe:2.3:a:wpbakery:page_builder:*:*:*:*:*:wordpress:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update WPBakery Page Builder to the latest release (8.4.2 or newer).
If an upgrade is not possible, disable or remove the Grid Builder feature entirely.
Apply a Content Security Policy that blocks inline script execution to mitigate XSS risk.

Generated by OpenCVE AI on April 21, 2026 at 20:08 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-18682	The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Builder feature in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://kb.wpbakery.com/docs/preface/release-notes/
https://www.wordfence.com/threat-intel/vulnerabilities/id/a0489172-279c-4397-a937-bca4840a196f?source=cve

History

Jul 10, 2025 12:15 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wpbakery Wpbakery page Builder
CPEs		cpe:2.3:a:wpbakery:page_builder::::::wordpress::*
Vendors & Products		Wpbakery Wpbakery page Builder

Jun 20, 2025 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 19, 2025 7:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Builder feature in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title		WPBakery Page Builder <= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder
Weaknesses		CWE-79
References		https://kb.wpbakery.com/docs/preface/release-notes/ https://www.wordfence.com/threat-intel/vulnerabilities/id/a0489172-279c-4397-a937-bca4840a196f?source=cve
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`