CVE-2025-10006: WPBakery Page Builder XSS Vulnerability

CVE-2025-10006 Overview

CVE-2025-10006 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPBakery Page Builder plugin for WordPress. The flaw affects all versions up to and including 8.6 and resides in the plugin's rev_slider_vc shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated users with contributor-level access or above to inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who accesses an affected page. Exploitation requires the Slider Revolution (RevSlider) plugin to also be installed on the target site. The vulnerability is tracked under [CWE-79] and carries an EPSS probability of 0.217%.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site administrators and visitors, enabling session theft, account takeover, and content defacement.

Affected Products

WPBakery Page Builder for WordPress, all versions up to and including 8.6
Requires Slider Revolution (RevSlider) plugin to be installed for exploitation
WordPress sites permitting contributor-level accounts or higher

Discovery Timeline

2025-10-18 - CVE-2025-10006 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10006

Vulnerability Analysis

The vulnerability exists in the handling of the rev_slider_vc shortcode exposed by WPBakery Page Builder. The shortcode accepts user-controlled attributes that are rendered back into page markup without adequate sanitization or output escaping. An authenticated attacker holding at least contributor privileges can submit a post or page containing the shortcode with crafted attribute values that break out of the intended attribute context and inject arbitrary HTML or JavaScript.

Because the payload is stored in the WordPress database as post content, it fires every time a user renders the affected page. The scope-changed impact reflects the ability of injected script to affect resources beyond the vulnerable component, including sessions of higher-privileged users such as editors and administrators who preview or review contributor submissions.

Root Cause

The root cause is missing input sanitization on shortcode attribute parsing combined with absent output escaping when the shortcode is rendered to HTML. The plugin trusts attribute values supplied through the shortcode interface rather than treating them as untrusted user input. This is a classic Stored XSS pattern classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires network access to the target WordPress site and an authenticated account with contributor role or higher. The attacker composes a post or page that embeds the rev_slider_vc shortcode with malicious attribute values containing script content. When an editor, administrator, or site visitor renders the page, the browser parses and executes the injected script under the site's origin. The attack chain depends on the Slider Revolution plugin being present alongside WPBakery Page Builder, otherwise the shortcode handler is not activated.

No public proof-of-concept exploit code is currently listed for this issue. Technical details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-10006

Indicators of Compromise

Post or page content in wp_posts containing rev_slider_vc shortcodes with attribute values including <script, javascript:, onerror=, or onload= handlers.
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains after previewing contributor-submitted content.
New or modified administrator accounts, API keys, or plugin installations created shortly after a contributor edited a page containing the shortcode.

Detection Strategies

Query the WordPress database for posts containing the rev_slider_vc shortcode and inspect attribute values for HTML control characters, quote-breakout patterns, and event handler strings.
Deploy a web application firewall rule to inspect POST requests to /wp-admin/post.php and /wp-admin/admin-ajax.php for shortcode payloads containing script markup.
Review WordPress audit logs for contributor-role accounts submitting posts that reference RevSlider shortcodes, particularly on sites where contributors do not typically author slider content.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script execution attempts on rendered pages.
Monitor wp_users and wp_usermeta tables for privilege changes correlated with page previews of contributor content.
Alert on installation events for either WPBakery Page Builder or Slider Revolution and confirm both plugins are patched when co-resident.

How to Mitigate CVE-2025-10006

Immediate Actions Required

Update WPBakery Page Builder to a version released after 8.6 that addresses this shortcode sanitization flaw. Confirm the fix in the WPBakery Release Notes.
Audit existing posts and pages for malicious rev_slider_vc shortcode attribute values and remove any confirmed injections.
Review contributor and author accounts, rotating credentials for any account suspected of exploiting the flaw.

Patch Information

Site administrators should upgrade WPBakery Page Builder to the vendor-supplied fixed release documented in the WPBakery Release Notes. The Wordfence Vulnerability Report tracks fixed-version metadata and provides additional remediation guidance.

Workarounds

Uninstall or deactivate the Slider Revolution (RevSlider) plugin if it is not required, since exploitation depends on its presence.
Restrict contributor and author roles to trusted users only, or temporarily downgrade untrusted accounts until patching completes.
Deploy a web application firewall rule that blocks rev_slider_vc shortcode submissions containing HTML tags or JavaScript event handlers in attribute values.
Enforce a strict Content Security Policy that disallows inline scripts to limit the impact of any injected payloads.

bash

# Configuration example: WP-CLI commands to search for suspicious shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%rev_slider_vc%' AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%' OR post_content LIKE '%javascript:%');"

# List installed plugin versions to confirm patch status
wp plugin get js_composer --field=version
wp plugin get revslider --field=version