CVE-2025-4968 Overview
CVE-2025-4968 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPBakery Page Builder plugin for WordPress. The flaw affects all versions up to and including 8.4.1 and is tracked under [CWE-79]. Insufficient input sanitization and output escaping on user-supplied attributes across multiple Page Builder elements allow authenticated attackers with contributor-level access to inject arbitrary JavaScript. The payload executes in the browser of any visitor who views the injected page. Affected elements include Copyright, Hover Box, Separator With Text, FAQ, Single Image, Custom Header, Button, Call To Action, Progress Bar, Pie Chart, Round Chart, and Line Chart.
Critical Impact
Authenticated contributors can store malicious scripts in published pages, enabling session hijacking, credential theft, and administrative account takeover against site visitors and editors.
Affected Products
- WPBakery Page Builder for WordPress — all versions through 8.4.1
- WordPress sites allowing contributor-level registration or above
- Themes and bundled distributions shipping WPBakery ≤ 8.4.1
Discovery Timeline
- 2025-07-24 - CVE-2025-4968 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-4968
Vulnerability Analysis
The vulnerability is a Stored Cross-Site Scripting flaw rooted in how WPBakery Page Builder processes shortcode attributes supplied through its visual editor. When a user with contributor privileges or higher saves a page containing one of the affected elements, the plugin stores attribute values without applying adequate sanitization. On rendering, those attributes are emitted into the HTML output without sufficient escaping, allowing attacker-controlled JavaScript to execute in the browser of anyone who loads the page.
Because the injection is stored server-side within post content, it persists across sessions and users. Any editor, administrator, or visitor opening the compromised page triggers execution of the attacker's payload. The scope-changed impact enables an attacker operating with low-privileged credentials to reach higher-privileged users through the browser session boundary.
Root Cause
The root cause is improper neutralization of input during web page generation. The affected shortcode handlers accept rich attribute values from the editor interface and fail to apply WordPress escaping primitives such as esc_attr(), esc_html(), or wp_kses() consistently before output. Twelve distinct elements share this pattern, indicating a systemic sanitization gap in the element registration layer rather than a single isolated handler.
Attack Vector
An authenticated attacker holding a Contributor, Author, Editor, or Administrator role crafts a page or post using one of the vulnerable Page Builder elements. The attacker supplies a malicious JavaScript payload inside an attribute field such as a button label, image caption, chart title, or custom header text. After submitting the content for review or publication, the stored payload executes whenever a reviewer, editor, or site visitor renders the page. See the Wordfence Vulnerability Analysis for element-specific details.
Detection Methods for CVE-2025-4968
Indicators of Compromise
- Post or page content in wp_posts.post_content containing <script>, onerror=, onload=, or javascript: strings inside WPBakery shortcodes such as [vc_btn], [vc_single_image], [vc_cta], or [vc_pie].
- Unexpected outbound requests from browsers viewing editor or preview screens to attacker-controlled domains.
- New administrator accounts or privilege changes shortly after a contributor submitted content for review.
Detection Strategies
- Audit the WordPress database for shortcode attributes containing event handlers, inline scripts, or data-URI schemes.
- Review web server access logs for POST requests to /wp-admin/post.php and /wp-admin/admin-ajax.php from contributor accounts preceding anomalous visitor sessions.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from Page Builder-rendered pages.
Monitoring Recommendations
- Alert on creation or modification of posts by low-privilege users where saved content contains HTML event attributes or <script> tags.
- Monitor WordPress audit logs for role changes, plugin installations, and option updates following contributor publishing activity.
- Track browser-side errors and CSP violations tied to specific post IDs to identify active injection attempts.
How to Mitigate CVE-2025-4968
Immediate Actions Required
- Update WPBakery Page Builder to a version later than 8.4.1 as published in the WPBakery Release Notes.
- Review all pages and posts created or edited by contributor and author accounts since the plugin was installed, and strip suspicious shortcode attributes.
- Temporarily restrict content submission from untrusted contributor accounts until patching is complete.
Patch Information
WPBakery addresses the vulnerability in releases following version 8.4.1. Site operators should consult the WPBakery Release Notes and apply the fixed release through the WordPress plugin updater or by replacing the plugin directory with the patched build. Verify the installed version under Plugins → Installed Plugins after the update completes.
Workarounds
- Remove or deactivate WPBakery Page Builder on sites that cannot be updated immediately.
- Revoke publishing and content creation privileges from untrusted Contributor and Author accounts until the patched release is deployed.
- Deploy a web application firewall rule or WordPress security plugin signature that blocks shortcode attribute values containing <script, onerror, onload, or javascript: tokens.
- Enforce a strict Content Security Policy that disallows inline script execution on front-end pages.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
