The vulnerability in WPBakery Page Builder allows an authenticated attacker with subscriber-level or higher privileges to inject scripts that are stored and later rendered on pages. By exploiting the unescaped 'data' parameter, a malicious user can encode arbitrary JavaScript in base64, bypassing the WP_kses_post sanitization, which is then decoded and echoed without escaping by the vc_raw_html shortcode template. This stored payload executes whenever any visitor views the affected page, enabling session hijacking, defacement, and other client‑side attacks.

All installations of WPBakery Page Builder version 8.7.4 and earlier are affected. The plugin must be upgraded to 8.7.5 or later to remediate the flaw. Users with subscriber‑level access are the minimum privilege required to exploit this issue; administrators can also exploit it.

The CVSS score of 6.4 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA KEV, which suggests it has not yet been widely exploited in the wild but could be leveraged by legitimate users with elevated privileges. The attack vector is authenticated, requiring the attacker to be logged in and to have permission to edit or create content. Once injected, the script persists and executes on every page view with the embedded shortcode, posing a high risk of cross‑site script attacks for site visitors.