CVE-2025-69390: WPBakery Page Builder Reflected XSS Flaw

CVE-2025-69390 Overview

CVE-2025-69390 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting Business Template Blocks for WPBakery (Visual Composer) Page Builder, a WordPress plugin developed by themebon. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing attackers to inject malicious scripts that execute in the context of a victim's browser session.

Reflected XSS vulnerabilities are particularly dangerous in WordPress environments as they can be weaponized through phishing campaigns or malicious links to compromise site administrators and visitors. When exploited, attackers can steal session cookies, hijack user accounts, deface web content, or redirect users to malicious websites.

Critical Impact

This vulnerability enables remote attackers to execute arbitrary JavaScript code in victim browsers without authentication, potentially leading to credential theft, session hijacking, and website defacement across all WordPress installations using affected plugin versions.

Affected Products

• Business Template Blocks for WPBakery (Visual Composer) Page Builder versions up to and including 1.3.2
• WordPress sites utilizing the templates-and-addons-for-wpbakery-page-builder plugin
• All WordPress installations running vulnerable versions of the themebon plugin

Discovery Timeline

• 2026-02-20 - CVE-2025-69390 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2025-69390

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in the Business Template Blocks for WPBakery Page Builder plugin, which fails to properly sanitize user-controlled input before reflecting it back in HTTP responses.

In a Reflected XSS attack scenario, an attacker crafts a malicious URL containing JavaScript payload in a vulnerable parameter. When an unsuspecting user clicks this link, the plugin processes the request and echoes the malicious input directly into the page response without proper encoding or validation. The victim's browser then executes the injected script as if it were legitimate content from the WordPress site.

The vulnerability is exploitable over the network and requires user interaction (victim must click a malicious link), but does not require any prior authentication. This makes it ideal for targeted phishing campaigns against WordPress administrators.

Root Cause

The root cause of CVE-2025-69390 is insufficient input validation and output encoding within the plugin's handling of user-supplied data. The plugin fails to implement proper sanitization functions such as esc_html(), esc_attr(), or wp_kses() that WordPress provides for preventing XSS attacks. When user input is reflected in the HTML response without these security measures, it creates an injection point for malicious scripts.

Attack Vector

The attack vector leverages the network-accessible nature of WordPress sites. An attacker constructs a specially crafted URL containing malicious JavaScript payload targeting the vulnerable plugin parameter. The attack flow typically follows this pattern:

1. Attacker identifies a WordPress site running a vulnerable version of Business Template Blocks for WPBakery
2. Attacker crafts a malicious URL with JavaScript payload embedded in the vulnerable parameter
3. Attacker distributes the malicious link via email, social media, or other communication channels
4. When a victim (particularly a site administrator) clicks the link, the malicious script executes
5. The script can steal session cookies, perform actions as the victim, or redirect to phishing sites

The vulnerability mechanism involves improper handling of user input in the plugin's template rendering functions. When a request containing a malicious payload reaches the vulnerable endpoint, the plugin reflects the unsanitized input directly into the HTML response. See the Patchstack WordPress Vulnerability Report for detailed technical information.

Detection Methods for CVE-2025-69390

Indicators of Compromise

• Suspicious outbound requests from WordPress site containing JavaScript payloads in URL parameters
• Web server access logs showing unusual query strings with encoded script tags or event handlers
• User reports of unexpected browser behavior or redirects when visiting the WordPress site
• Authentication anomalies or unauthorized administrative actions following link clicks

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in request parameters
• Monitor access logs for patterns indicative of XSS exploitation attempts, including <script>, javascript:, and event handler injections
• Deploy Content Security Policy (CSP) headers to mitigate the impact of successful XSS attacks
• Utilize WordPress security plugins that scan for known vulnerable plugin versions

Monitoring Recommendations

• Enable detailed logging for the WPBakery Page Builder and associated template plugins
• Configure security information and event management (SIEM) alerts for XSS attack patterns
• Monitor for unexpected outbound connections that may indicate cookie exfiltration
• Review administrative action logs for unauthorized changes following potential exploitation

How to Mitigate CVE-2025-69390

Immediate Actions Required

• Audit WordPress installations to identify sites running Business Template Blocks for WPBakery Page Builder version 1.3.2 or earlier
• Disable or deactivate the vulnerable plugin until a patched version is available
• Implement a Web Application Firewall (WAF) with XSS protection rules
• Educate site administrators about the risks of clicking untrusted links

Patch Information

Organizations should monitor the Patchstack WordPress Vulnerability Report and the plugin's official repository for security updates. Update to a patched version as soon as it becomes available from themebon.

Workarounds

• Temporarily disable the Business Template Blocks for WPBakery plugin if not critical to site functionality
• Implement strict Content Security Policy (CSP) headers to prevent inline script execution
• Use WordPress security plugins like Wordfence or Sucuri to add virtual patching capabilities
• Consider restricting plugin access to authenticated users only until patched

# WordPress configuration - Add CSP headers via .htaccess
# Add to your WordPress root .htaccess file

<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
</IfModule>