CVE-2026-15101: WPBakery Page Builder XSS Vulnerability

CVE-2026-15101 Overview

CVE-2026-15101 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPBakery Page Builder plugin for WordPress. The flaw affects all versions up to and including 8.7.4 and stems from insufficient input sanitization and output escaping around the data parameter. Authenticated attackers holding subscriber-level access or higher can inject arbitrary JavaScript that executes when any user views an affected page. The issue is tracked under CWE-79.

Critical Impact
Any authenticated subscriber can persist JavaScript payloads that execute in the browsers of site visitors and administrators, enabling session theft, account takeover, and malicious redirection.

Affected Products

WPBakery Page Builder plugin for WordPress
All versions through 8.7.4
WordPress sites permitting subscriber-level registration

Discovery Timeline

2026-09-01 - CVE-2026-15101 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-15101

Vulnerability Analysis

The vulnerability resides in how WPBakery Page Builder processes and later renders content supplied through the data parameter used by settings presets. On save, WPBakery applies wp_kses_post to strip disallowed HTML. However, an attacker submitting a payload that is base64-encoded appears to the sanitizer as inert alphanumeric text with no HTML tags to remove. The sanitizer therefore passes the string through unchanged.

At render time, the vc_raw_html shortcode template decodes the stored value and echoes it directly into the page output without escaping. The decoded content is interpreted by the browser as HTML and JavaScript, resulting in stored XSS. Because the payload persists in post content, every visitor to the affected page triggers execution.

Root Cause

The root cause is a mismatch between sanitization context and rendering context. wp_kses_post only inspects HTML that is present at save time. The vc_raw_html shortcode template at vc_raw_html.php performs base64_decode on stored data and emits the result without a subsequent call to esc_html or wp_kses_post. This violates the principle of contextual output encoding.

Attack Vector

An attacker authenticates with any account of subscriber role or above. They submit crafted preset or shortcode content where the malicious script is base64-encoded within the data parameter, referenced in the plugin hooks at vc-settings-presets.php and the settings-presets class. The payload survives sanitization, is stored in the database, and executes on every subsequent page view. The attack is network-exploitable and requires no user interaction beyond visiting the compromised page.

Detection Methods for CVE-2026-15101

Indicators of Compromise

Unexpected base64-encoded strings inside vc_raw_html shortcodes in wp_posts content.
New or modified WPBakery settings presets created by low-privilege accounts.
Outbound requests from visitor browsers to attacker-controlled domains following page views.
Subscriber-role accounts performing content or preset write operations they do not normally perform.

Detection Strategies

Query the wp_posts table for vc_raw_html shortcodes and decode embedded base64 content to inspect for <script> tags, event handlers, or eval usage.
Monitor WordPress audit logs for preset save actions originating from subscriber accounts.
Deploy Content Security Policy (CSP) reporting endpoints to surface inline script violations on public pages.

Monitoring Recommendations

Alert on HTTP POST requests to admin-ajax.php invoking WPBakery preset actions from non-editor users.
Track file integrity for plugin files under wp-content/plugins/js_composer/.
Review the Wordfence Vulnerability Report for signature updates and known payload patterns.

How to Mitigate CVE-2026-15101

Immediate Actions Required

Update WPBakery Page Builder to a version above 8.7.4 as soon as the vendor releases a fix.
Audit user accounts and remove or downgrade unnecessary subscriber-level registrations.
Disable open user registration on production WordPress sites that do not require it.
Scan existing content for stored payloads and purge or sanitize any base64-encoded blobs found inside vc_raw_html shortcodes.

Patch Information

At the time of publication, the NVD entry does not list a fixed version. Administrators should monitor the WPBakery vendor advisories and the WordPress plugin repository for a release that addresses insufficient output escaping in the vc_raw_html shortcode template.

Workarounds

Restrict the vc_raw_html shortcode using WordPress role editors or a remove_shortcode('vc_raw_html') snippet where the feature is not required.
Enforce a strict Content Security Policy that disallows inline script execution to blunt exploitation impact.
Place the site behind a Web Application Firewall with rules that inspect decoded base64 payloads within shortcode parameters.
Limit the edit_posts and related capabilities so that subscriber-tier accounts cannot invoke WPBakery preset endpoints.

bash

# Example: remove the vulnerable shortcode via mu-plugin until patched
# File: wp-content/mu-plugins/disable-vc-raw-html.php
<?php
add_action('init', function () {
    remove_shortcode('vc_raw_html');
}, 20);