CVE-2025-4965: WPBakery Page Builder XSS Vulnerability

CVE-2025-4965 Overview

CVE-2025-4965 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WPBakery Page Builder plugin for WordPress. The flaw exists in the plugin's Grid Builder feature and affects all versions up to and including 8.4.1. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with author-level privileges or higher to inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits the affected page.

Critical Impact
Author-level users can persist malicious scripts that execute against site visitors and administrators, enabling session theft, forced administrative actions, and site defacement.

Affected Products

WPBakery Page Builder for WordPress — all versions up to and including 8.4.1
WordPress sites using the Grid Builder feature of WPBakery Page Builder
Any WordPress deployment granting author-level or higher access to untrusted users

Discovery Timeline

2025-06-19 - CVE-2025-4965 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4965

Vulnerability Analysis

The vulnerability resides in the Grid Builder component of WPBakery Page Builder. The plugin accepts user-supplied attributes when constructing grid elements but fails to properly sanitize input on write and escape output on render. As a result, attacker-controlled markup persists in the WordPress database and is emitted verbatim inside rendered pages.

An authenticated attacker with the author role or higher can insert JavaScript payloads through Grid Builder attributes. When any user, including administrators, loads a page containing the injected grid, the browser executes the payload in the site's origin. Because the payload runs in the victim's authenticated session, it can perform actions on their behalf, exfiltrate cookies not marked HttpOnly, or manipulate DOM content to phish credentials.

User interaction is required, since a victim must load the affected page. The scope is changed because the injected script executes in the trust context of any viewer, including higher-privileged accounts.

Root Cause

The root cause is missing input sanitization and missing output escaping on attributes passed to Grid Builder shortcodes and templates. The plugin trusts author-supplied attribute values and reflects them into HTML contexts without applying WordPress functions such as esc_attr(), esc_html(), or wp_kses(). This is a classic Stored XSS pattern tracked under CWE-79.

Attack Vector

Exploitation requires an authenticated session with at least author-level capabilities on the target WordPress site. The attacker crafts a Grid Builder element containing a malicious attribute value with an embedded script or event handler. The payload is stored in the database when the post or page is saved. Any subsequent request to the rendered page triggers script execution in the viewer's browser. See the Wordfence Vulnerability Report for technical details.

// No verified proof-of-concept code is publicly available.
// The vulnerability is triggered by supplying unsanitized JavaScript
// within Grid Builder attributes stored in post content.

Detection Methods for CVE-2025-4965

Indicators of Compromise

Unexpected <script> tags or JavaScript event handlers (onerror, onload, onmouseover) present in WordPress post_content for pages using WPBakery grids.
New or modified administrator accounts created shortly after an author-level user edited a page containing a WPBakery grid.
Outbound requests from browsers loading site pages to unfamiliar third-party domains, indicating cookie or data exfiltration.
Modifications to wp_options values such as siteurl or home following page views by administrators.

Detection Strategies

Query the WordPress database for grid shortcodes containing suspicious attribute strings, for example SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%vc_%' AND post_content REGEXP '(<script|onerror=|onload=|javascript:)';.
Review author and contributor activity logs for edits to pages that render WPBakery Grid Builder elements.
Deploy Content Security Policy (CSP) reporting to surface inline script execution originating from unexpected sources.

Monitoring Recommendations

Alert on privilege changes and new administrator accounts, correlating them with recent edits by non-administrative roles.
Monitor plugin version inventory across WordPress fleets to identify hosts still running WPBakery Page Builder 8.4.1 or earlier.
Log and review all page saves performed by author-role users, with attention to shortcode attribute content.

How to Mitigate CVE-2025-4965

Immediate Actions Required

Update WPBakery Page Builder to a version later than 8.4.1 as listed in the WPBakery Release Notes.
Audit all users with author, editor, and administrator roles, and remove or downgrade accounts that no longer require content creation privileges.
Inspect existing pages built with Grid Builder for stored payloads and remove any suspicious markup before it renders to visitors.
Rotate administrator credentials and invalidate active sessions if signs of exploitation are present.

Patch Information

WPBakery has released a fixed version addressing the input sanitization and output escaping deficiencies in the Grid Builder feature. Refer to the WPBakery Release Notes for the specific patched release and update all affected WordPress installations. Confirm the plugin version reported in the WordPress admin panel matches the patched release after applying the update.

Workarounds

Restrict author-level and higher roles to trusted users only until the patch is applied.
Disable the WPBakery Page Builder plugin on sites where an immediate update is not feasible.
Deploy a Web Application Firewall (WAF) rule to block requests containing script tags or JavaScript event handlers in WPBakery shortcode parameters.
Enforce a strict Content Security Policy that disallows inline scripts to limit the impact of stored payloads.

bash

# Example: identify WordPress sites running vulnerable WPBakery versions
wp plugin list --format=csv | grep -i js_composer
wp plugin update js_composer