2 matches found
CVE-2025-11161
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vccustomheading shortcode in all versions up to, and including, 8.6.1. This is due to insufficient restriction of allowed HTML tags and improper sanitization of user-supplied attributes in the...
6.4CVSS0.00213EPSS
SaveExploits0References2
CVE-2025-11161: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vccustomheading shortcode in all versions up to, and including, 8.6.1. This is due to insufficient restriction of allowed HTML tags and improper sanitization of user-supplied attributes in the...
6.4CVSS6.1AI score0.00213EPSS
SaveExploits0References1
20