The Export & Import WPBakery Page Builder WordPress plugin does not perform a CSRF check on its template‑import feature and fails to sanitise the data before storing it and echoing it back. An attacker can forge a request from an authenticated administrator’s session, supply a malicious template, and the plugin will write that data to the database and later render it unescaped. This results in stored XSS that executes in the administrator's browser context, allowing credential theft, session hijack, or defacement of the site.

All WordPress installations using Export & Import WPBakery Page Builder version 1.0.2 or earlier are affected. The flaw requires no special hosting environment beyond a standard WordPress deployment.

The vulnerability carries a CVSS score of 7.1, indicating high severity, and an EPSS score of less than 1%, implying a low current exploitation probability. It has not been listed in CISA’s KEV catalog. Exploitation requires the attacker to lure a privileged administrator into initiating a CSRF‑enforced import action, typically via a malicious link or social‑engineering trick. Once the stored XSS payload is executed in the admin’s browser, the attacker can hijack the session, steal credentials, or perform any administrative action, effectively taking control of the WordPress site. Because the payload is stored, it remains active until the site is cleaned or the plugin is updated.