WPBakery Page Builder for WordPress allows authenticated users with contributor or higher privileges to inject arbitrary web scripts by taking advantage of insufficient input sanitization and output escaping on user supplied attributes within multiple shortcodes. The stored XSS flaw results in malicious scripts executing whenever any visitor loads a page that contains the injected content, enabling credential theft, session hijacking, or other malicious actions without the visitor’s knowledge.

The vulnerability targets the WPBakery Page Builder plugin for WordPress, affecting all released versions up to and including 8.5. Any WordPress site that has the plugin installed and includes users with contributor or higher roles is potentially exposed; the specific WordPress core version is not a factor. No additional external components are required for the exploit.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% implies a low current likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no publicly known exploits at this time. Nevertheless, an attacker only needs to authenticate as a contributor or higher to inject malicious code, after which the code persists on the site and runs for all subsequent visitors, making it a potentially high-impact vector if the threat actor obtains such credentials.