CVE-2020-28650: WPBakery Page Builder XSS Vulnerability

CVE-2020-28650 Overview

CVE-2020-28650 is a Cross-Site Scripting (XSS) vulnerability affecting the WPBakery Page Builder plugin for WordPress. The vulnerability exists because the plugin calls kses_remove_filters to disable WordPress's standard XSS protection mechanism for users with the Author and Contributor roles. This security flaw allows lower-privileged authenticated users to inject malicious scripts that can be executed in the browsers of other users, including administrators.

Critical Impact

This vulnerability exposes over 4 million WordPress sites using WPBakery Page Builder to stored XSS attacks, potentially allowing account takeover, session hijacking, and administrative compromise through malicious script injection.

Affected Products

• WPBakery Page Builder versions prior to 6.4.1
• WordPress installations using vulnerable WPBakery Page Builder plugin
• Sites allowing Author or Contributor user roles with access to the page builder

Discovery Timeline

• 2020-11-16 - CVE CVE-2020-28650 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-28650

Vulnerability Analysis

The vulnerability stems from the WPBakery Page Builder's intentional disabling of WordPress's built-in content sanitization mechanisms. WordPress provides robust XSS protection through its KSES (KSES Strips Evil Scripts) filtering system, which sanitizes user-submitted content to remove potentially malicious HTML and JavaScript.

WPBakery Page Builder circumvents this protection by calling kses_remove_filters(), a WordPress function that temporarily disables KSES filtering. While this approach allows users to embed rich content within page builder elements, it creates a significant security gap for users with Author and Contributor roles, who are not typically trusted with unfiltered HTML capabilities.

In WordPress's security model, only Administrators and Editors possess the unfiltered_html capability by default. By removing KSES filters for lower-privileged users, the plugin effectively grants them elevated content privileges, enabling the injection of arbitrary JavaScript code that persists in the database and executes when pages are viewed.

Root Cause

The root cause is the improper handling of user role permissions when invoking kses_remove_filters(). The plugin fails to verify whether the current user should have the unfiltered_html capability before disabling WordPress's XSS protection mechanisms. This design flaw allows Authors and Contributors—who are typically only semi-trusted users—to bypass content security restrictions that WordPress enforces by default.

Attack Vector

An attacker with Author or Contributor privileges on a vulnerable WordPress installation can exploit this vulnerability through the following attack flow:

1. The attacker authenticates to the WordPress dashboard with Author or Contributor role credentials
2. Using WPBakery Page Builder's interface, the attacker creates or edits page content
3. The attacker injects malicious JavaScript code within page builder elements
4. When kses_remove_filters() is called, WordPress's XSS sanitization is bypassed
5. The malicious script is saved to the database without sanitization
6. When an administrator or other user views the affected page, the malicious script executes in their browser context
7. The attacker can then steal session cookies, perform actions on behalf of the victim, or escalate privileges

This is a stored XSS vulnerability that requires user interaction (viewing the compromised page) but can be highly effective since the malicious content persists and affects all users who view the page.

Detection Methods for CVE-2020-28650

Indicators of Compromise

• Unexpected JavaScript code or <script> tags in page builder content created by Authors or Contributors
• Suspicious event handlers (onclick, onerror, onload) embedded in page content
• Anomalous admin account creation or privilege changes following page views
• Session hijacking indicators or unexplained administrative actions

Detection Strategies

• Review page builder content from Author and Contributor roles for embedded scripts or suspicious HTML
• Implement Web Application Firewall (WAF) rules to detect XSS payload patterns in POST requests to page builder endpoints
• Monitor WordPress audit logs for content modifications by lower-privileged users containing HTML event handlers
• Scan stored page content for common XSS patterns and obfuscated JavaScript

Monitoring Recommendations

• Enable comprehensive logging for all page builder content submissions and modifications
• Deploy real-time alerting for detection of script tags or JavaScript event handlers in Author/Contributor submissions
• Regularly audit user role assignments to ensure only trusted users have content creation capabilities
• Monitor for signs of privilege escalation or unauthorized administrative actions following page views

How to Mitigate CVE-2020-28650

Immediate Actions Required

• Update WPBakery Page Builder to version 6.4.1 or later immediately
• Review all existing page content created by Authors and Contributors for malicious scripts
• Temporarily restrict page builder access for Author and Contributor roles until patching is complete
• Audit user accounts for any signs of compromise or unauthorized privilege escalation

Patch Information

The vulnerability is remediated in WPBakery Page Builder version 6.4.1 and later. The patch addresses the improper use of kses_remove_filters() by ensuring that XSS protection mechanisms remain active for users without the unfiltered_html capability. Site administrators should update the plugin through the WordPress dashboard or by downloading the latest version from the official WPBakery website. For additional technical details, see the Wordfence Blog on WPBakery Vulnerability.

Workarounds

• Remove page builder access from Author and Contributor roles by adjusting role capabilities using a role editor plugin
• Implement a content review workflow requiring Editor or Administrator approval before publishing Author/Contributor content
• Deploy a Web Application Firewall with XSS protection rules targeting page builder submission endpoints
• Consider limiting Author and Contributor accounts to only essential, trusted users until the plugin can be updated

# Example: Verify WPBakery Page Builder version via WP-CLI
wp plugin list --name=js_composer --fields=name,version,status

# Update WPBakery Page Builder to latest version
wp plugin update js_composer

# List users with Author or Contributor roles for review
wp user list --role=author --fields=ID,user_login,user_email
wp user list --role=contributor --fields=ID,user_login,user_email