CVE-2026-119165: WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name

Q: Which accounts can exploit this without help?

Author-level accounts can meet the required post-attribution condition themselves. Subscriber-level accounts can inject the payload, but need an administrator to assign or publish at least one public post under the subscriber's account.

Q: What site configuration must be present for the injected script to execute?

A public post attributed to the attacker's account must be rendered in a Basic Grid that uses a Grid Builder template. That template must include the Post Author element configured to link to the post author.

Q: Are sites affected by default?

The vulnerability affects plugin versions through 9.0.1, but script execution depends on the specific Basic Grid and Post Author link configuration described. The provided information does not establish that this configuration is enabled by default.

Q: How can administrators check for exposure?

Review Basic Grid instances and their Grid Builder templates for a Post Author element configured to link to the post author. Also identify public posts attributed to low-privilege accounts, especially subscribers whose posts may have been assigned or published by an administrator.

Published Nov 7, 2026

Updated

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname / nickname' parameter in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires that at least one public post attributed to the attacker's account be rendered through a Basic Grid using a Grid Builder template with the Post Author element configured to link to the post author; Author-level users can satisfy this precondition unassisted, while Subscribers depend on an administrator having assigned or published a post under their account.

Event History

Nov 7, 2026

CVE Published

via MITRE·02:29 AM

Data Sourced

via MITRE·02:29 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which accounts can exploit this without help?

Author-level accounts can meet the required post-attribution condition themselves. Subscriber-level accounts can inject the payload, but need an administrator to assign or publish at least one public post under the subscriber's account.

What site configuration must be present for the injected script to execute?

A public post attributed to the attacker's account must be rendered in a Basic Grid that uses a Grid Builder template. That template must include the Post Author element configured to link to the post author.

Are sites affected by default?

The vulnerability affects plugin versions through 9.0.1, but script execution depends on the specific Basic Grid and Post Author link configuration described. The provided information does not establish that this configuration is enabled by default.

How can administrators check for exposure?

Review Basic Grid instances and their Grid Builder templates for a Post Author element configured to link to the post author. Also identify public posts attributed to low-privilege accounts, especially subscribers whose posts may have been assigned or published by an administrator.

CVE-2026-119165: WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name

Event History

Frequently Asked Questions

Which accounts can exploit this without help?

What site configuration must be present for the injected script to execute?

Are sites affected by default?

How can administrators check for exposure?

Company

Resources

Contact

Frequently Asked Questions

Which accounts can exploit this without help?

What site configuration must be present for the injected script to execute?

Are sites affected by default?

How can administrators check for exposure?