CVE-2024-5709

WPBakery Visual Composer Local File Inclusion (CVE-2024-5709) affects WPBakery Visual Composer up to version 7.7 via the layout_name parameter. Exploitation requires Author-level access (plus post-permissions granted by an Administrator) to include/execute arbitrary PHP files on the server, enabl...

CVE-2024-1841

CVE-2024-1841 concerns the WPBakery Visual Composer (aka WPBakery Page Builder, JS Composer) WordPress plugin. In versions up to and including 7.5, it is vulnerable to Stored Cross-Site Scripting via the Post Title tag attribute due to insufficient input sanitization and output escaping. With aut...

CVE-2023-31213

CVE-2023-31213: WPBakery Page Builder (JS_CComposer) contains a stored XSS in versions

CVE-2020-28650

Summary: CVE-2020-28650 affects the WordPress WPBakery Page Builder (pre-6.4.1). The vulnerability arises because the plugin calls kses_remove_filters to disable WordPress XSS protections for the Author and Contributor roles, enabling cross-site scripting. Impact (as described): XSS that can be t...

CVE-2024-1840

The CVE-2024-1840 entry concerns WPBakery Visual Composer (js_composer) for WordPress. It describes a Stored Cross-Site Scripting vulnerability via the Post Author tag attribute in all versions up to and including 7.5. Exploitation requires authentication with Contributor+ privileges, enabling an...

CVE-2024-1805

CVE-2024-1805 affects the WPBakery Visual Composer WordPress plugin (js_composer) up to version 7.5. The issue is a Stored Cross‑Site Scripting vulnerability via the button onclick attribute, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access...

CVE-2024-1842

CVE-2024-1842 : WPBakery Visual Composer (WordPress)

CVE-2025-4965

CVE-2025-4965 (WPBakery Page Builder for WordPress) is a stored XSS vulnerability in the Grid Builder of WPBakery Page Builder, affecting all versions up to 8.4.1. The root cause is insufficient input sanitization and output escaping on user-supplied attributes, enabling an authenticated attacker...

CVE-2024-43953

CVE-2024-43953 : Stored XSS in Classic Addons – WPBakery Page Builder (Classic Addons) affecting versions up to 3.0. Root cause: improper neutralization of input during web page generation. Public documents do not provide exploitation details or a patch status; monitor for updates from the vendor...

CVE-2025-11161

CVE-2025-11161 affects the WPBakery Page Builder plugin for WordPress (versions up to 8.6.1). The vulnerability is a Stored Cross-Site Scripting (XSS) in the vc_custom_heading shortcode due to insufficient restriction of allowed HTML tags and improper sanitization of font_container attributes. Th...

CVE-2025-7502

The CVE-2025-7502 vulnerability affects the WPBakery Page Builder for WordPress plugin (WordPress). It is a Stored Cross-Site Scripting flaw in multiple shortcodes caused by insufficient input sanitization and output escaping of user-supplied attributes. Exploitation requires authentication at co...

CVE-2025-10006

CVE-2025-10006 affects WPBakery Page Builder for WordPress (

CVE-2025-4968

The CVE-2025-4968 entry concerns the WPBakery Page Builder for WordPress plugin (affected: WPBakery Page Builder

CVE-2025-11160

The CVE CVE-2025-11160 applies to the WPBakery Page Builder (WordPress) and is a stored XSS via the Custom JS module in all versions up to 8.6.1. The vulnerability arises from insufficient input sanitization and output escaping of user-supplied JavaScript, enabling authenticated users with contri...