CVE-2025-11160: WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via Custom JS Module
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1. This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS module. This makes it possible for authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the WPBakery Page Builder Custom JS module granted they have access to the WPBakery editor for post types.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11160?
CVE-2025-11160 is classified as a medium severity vulnerability due to its potential for exploitation via Stored Cross-Site Scripting.
How do I fix CVE-2025-11160?
To fix CVE-2025-11160, update the WPBakery Page Builder plugin to version 8.6.2 or later, which addresses the input sanitization issues.
Which versions of WPBakery Page Builder are affected by CVE-2025-11160?
CVE-2025-11160 affects all versions of WPBakery Page Builder up to and including version 8.6.1.
What type of vulnerability is CVE-2025-11160?
CVE-2025-11160 is a Stored Cross-Site Scripting vulnerability that occurs due to insufficient sanitization of user-supplied JavaScript.
What is the impact of CVE-2025-11160 on websites?
The impact of CVE-2025-11160 on websites includes potential unauthorized script execution in the user's browser, leading to data theft or session hijacking.