CVE-2026-27363: WP Bakery Autoresponder Addon XSS Flaw

CVE-2026-27363 Overview

CVE-2026-27363 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WP Bakery Autoresponder Addon (vc-autoresponder-addon) WordPress plugin developed by kamleshyadav. This vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing attackers to inject malicious scripts that are persistently stored on the server and executed in the browsers of users who view the affected pages.

Stored XSS vulnerabilities are particularly dangerous because the malicious payload persists on the target system, affecting all users who access the compromised content without requiring further attacker interaction.

Critical Impact

Attackers can inject persistent malicious scripts that execute in victim browsers, potentially leading to session hijacking, credential theft, website defacement, or malware distribution to site visitors.

Affected Products

• WP Bakery Autoresponder Addon (vc-autoresponder-addon) versions through 1.0.6
• WordPress sites running the vulnerable plugin versions

Discovery Timeline

• 2026-03-05 - CVE-2026-27363 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-27363

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The Stored XSS variant indicates that malicious script content is saved to the WordPress database and subsequently rendered to users without proper sanitization or encoding.

The WP Bakery Autoresponder Addon integrates with WPBakery Page Builder to provide autoresponder functionality. Due to insufficient input validation and output encoding within the plugin's components, attackers with the ability to submit input through the plugin's forms or settings can inject JavaScript code that persists in the database and executes when the content is displayed to other users.

Root Cause

The root cause of this vulnerability is the failure to properly sanitize user input before storing it in the database and the lack of output encoding when rendering stored content in HTML contexts. The plugin does not implement adequate security controls to neutralize special characters such as <, >, ", and ' that can be used to break out of HTML contexts and inject executable scripts.

WordPress provides built-in sanitization functions like wp_kses(), esc_html(), and esc_attr() that should be applied to user-supplied data. The absence or improper use of these functions in the WP Bakery Autoresponder Addon allows malicious scripts to be stored and executed.

Attack Vector

The attack vector involves an attacker who can submit input to fields processed by the vulnerable plugin. The attacker crafts input containing JavaScript payloads that bypass any existing validation. When this input is stored in the WordPress database and later rendered to other users (including administrators), the malicious script executes in their browser context.

A typical attack scenario involves injecting script tags or JavaScript event handlers into form fields or configuration options. When an administrator views a page containing the malicious content, the script executes with the administrator's session context, potentially allowing the attacker to hijack the session, create new admin accounts, or modify site content.

The vulnerability affects the plugin's data handling pipeline where user input flows from submission to storage to display without proper encoding at each stage.

Detection Methods for CVE-2026-27363

Indicators of Compromise

• Unexpected <script> tags or JavaScript event handlers (e.g., onerror, onload) present in database content related to the autoresponder plugin
• Suspicious entries in WordPress plugin settings or form submissions containing encoded script payloads
• Browser console errors or unexpected script execution warnings when viewing pages using the plugin
• Unauthorized administrator accounts or unexpected changes to site configuration

Detection Strategies

• Review WordPress database tables associated with the vc-autoresponder-addon plugin for suspicious script content
• Implement Content Security Policy (CSP) headers to detect and block inline script execution, monitoring CSP violation reports
• Deploy Web Application Firewall (WAF) rules to identify XSS patterns in requests to the WordPress site
• Use WordPress security plugins that scan for known XSS patterns in stored content

Monitoring Recommendations

• Enable detailed logging for WordPress plugin activity and user input submissions
• Configure alerts for CSP violations that may indicate attempted or successful XSS exploitation
• Monitor for unexpected changes to user accounts, roles, or administrative settings
• Regularly audit plugin settings and stored content for anomalous entries

How to Mitigate CVE-2026-27363

Immediate Actions Required

• Deactivate and remove the WP Bakery Autoresponder Addon (vc-autoresponder-addon) plugin if version 1.0.6 or earlier is installed
• Audit the WordPress database for any injected malicious scripts in content managed by the plugin
• Review user accounts for unauthorized changes or new administrator accounts
• Check for available plugin updates that address this vulnerability from the plugin developer or official WordPress plugin repository

Patch Information

As of the publication date, users should check for updates from the plugin developer (kamleshyadav) or the Patchstack vulnerability advisory for the latest remediation guidance. If no patched version is available, consider replacing the plugin with a secure alternative.

Workarounds

• Disable the plugin until a patched version becomes available
• Implement a Web Application Firewall (WAF) with XSS protection rules to filter malicious input
• Apply Content Security Policy headers to restrict inline script execution and reduce XSS impact
• Restrict access to plugin configuration and forms to trusted users only

# Add Content Security Policy header in WordPress .htaccess (Apache)
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"
</IfModule>