PT-2025-42239 · WordPress · Wpbakery Page Builder

Published 2025-10-15 · Updated 2025-11-26 · CVE-2025-11161

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WPBakery Page Builder versions prior to 8.6.2

Description The WPBakery Page Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the vc custom heading shortcode. This is caused by inadequate restriction of permitted HTML tags and improper sanitization of user-supplied attributes within the font container parameter. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into posts. These scripts will execute when a user accesses an injected page using the vc custom heading shortcode with malicious tag and text attributes.

Recommendations Update WPBakery Page Builder to version 8.6.2 or later.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2025-11161

Affected Products

Wpbakery Page Builder

References · 7

• https://osv.dev/vulnerability/CVE-2025-11161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11161 · Security Note
• http://kb.wpbakery.com/docs/preface/release-notes · Note
• https://t.me/cveNotify/138715 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2772cade-c625-437a-b57b-ce8a2e3393bf?source=cve · Note
• https://t.me/cveNotify/144085 · Telegram Post
• https://twitter.com/CVEnew/status/1978562088927732045 · Twitter Post