WPBakery Page Builder is vulnerable to stored Cross‑Site Scripting through the display_name or nickname field when a post author element is rendered. The flaw allows an attacker to inject JavaScript that runs in browsers of any user who views the affected page. The vulnerability originates from insufficient input validation and lack of proper output escaping, a classic example of CWE‑79.

wpbakery:WPBakery Page Builder versions up to and including 9.0.1 are affected. The flaw can be exploited by users with subscriber level access or higher who own a post that appears via a Basic Grid using a Grid Builder template with the Post Author element linked to the author.

The CVSS score of 6.4 indicates moderate severity while the EPSS score is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires authenticated access; an author of a public post can satisfy the precondition unassisted, whereas a subscriber needs an administrator to publish or assign a post under their account. Attackers can exploit the flaw by injecting scripts that execute for every visitor accessing the page through the Basic Grid.