CVE-2025-4968

WPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements

View on CVE.org

Published Jul 24, 2025 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Page Builder elements (Copyright Element, Hover Box, Separator With Text, FAQ, Single Image, Custom Header, Button, Call To Action, Progress Bar, Pie Chart, Round Chart, and Line Chart) in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

Technical impact

A stored cross‑site scripting flaw exists in the WPBakery Page Builder WordPress plugin, allowing an authenticated user with contributor or higher access to inject arbitrary JavaScript into a page through several builder elements. The attacker can place malicious code into attributes of elements such as Copyright, Hover Box, FAQ, and various charts, and the script will run each time the page is viewed by any user. This vulnerability arises from insufficient input validation and output escaping and is classified as CWE‑79.

Affected Systems

The vulnerability affects all installations of WPBakery Page Builder version 8.4.1 or earlier. It applies to the WordPress plugin distributed by wpbakery and includes all supported page builder components. The plugin is widely deployed on many WordPress sites, making the scope of exposure broad for any site operating on the affected software version.

Risk and Exploitability

The CVSS base score of 6.4 indicates a moderate level of severity. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation at the time, and the vulnerability is not listed in CISA’s KEV catalog. Because exploitation requires only contributor‑level access, it is relatively easy for authenticated users to leverage the flaw. The risk is moderate, especially on sites with many contributors.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

wpbakery

WPBakery Page Builder

unaffected

Version	Status	Constraints
`0`	affected	≤ 8.4.1

Configuration 1 [-]

cpe:2.3:a:wpbakery:page_builder:*:*:*:*:*:wordpress:*:*

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—
Wpbakery	Wpbakery Visual Composer	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update WPBakery Page Builder to the latest release that resolves the stored XSS flaw; consult the vendor’s release notes for version details.
For environments that cannot upgrade immediately, disable write access for contributor roles to the affected Page Builder elements or block the plugin until a patch is applied.
After upgrading, verify that user‑supplied attributes are properly escaped and that no legacy scripts remain; apply any vendor‑recommended security hardening steps such as enabling CSP or restricting script execution domains.

Generated by OpenCVE AI on April 22, 2026 at 17:04 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-22479	The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Page Builder elements (Copyright Element, Hover Box, Separator With Text, FAQ, Single Image, Custom Header, Button, Call To Action, Progress Bar, Pie Chart, Round Chart, and Line Chart) in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.312% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://kb.wpbakery.com/docs/preface/release-notes/
https://www.wordfence.com/threat-intel/vulnerabilities/id/10945855-675a-4a85-8bb2-84bc40c1b826?source=cve

History

Nov 26, 2025 2:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wpbakery page Builder
CPEs		cpe:2.3:a:wpbakery:page_builder::::::wordpress::*
Vendors & Products		Wpbakery page Builder

Jul 24, 2025 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress Wpbakery Wpbakery wpbakery Visual Composer
Vendors & Products		Wordpress Wordpress wordpress Wpbakery Wpbakery wpbakery Visual Composer

Jul 24, 2025 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 24, 2025 4:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Page Builder elements (Copyright Element, Hover Box, Separator With Text, FAQ, Single Image, Custom Header, Button, Call To Action, Progress Bar, Pie Chart, Round Chart, and Line Chart) in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title		WPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements
Weaknesses		CWE-79
References		https://kb.wpbakery.com/docs/preface/release-notes/ https://www.wordfence.com/threat-intel/vulnerabilities/id/10945855-675a-4a85-8bb2-84bc40c1b826?source=cve
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`