The Export & Import WPBakery Page Builder WordPress plugin through version 1.0.2 fails to perform a CSRF check on its template‑import feature and does noting it back. An attacker can forge a request from an, and the plugin will render it unescaped. This results in stored cross‑site scripting executed in the administrator’s browser context.

All WordPress installations using Export & Import WPBakery Page Builder version 1.0.2 or earlier are affected. The vulnerability requires no special hosting environment beyond a standard WordPress deployment.

The vulnerability carries a CVSS score of 7.1, indicating high severity, and an EPSS score of less than 1%, implying a low current exploitation probability. It is not listed in CISA’s KEV catalog. Exploitation requires the attacker to entice a privileged administrator into initiating a CSRF‑enforced import action, typically via a malicious link or social‑engineering trick. Once the stored XSS payload is executed in the admin’s browser, the attacker can hijack the session, steal credentials, or perform any administrative action. These secondary consequences are inferred from the capabilities of the CVE description.