CVE-2026-15101: WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wpksespost sanitization applied during save does not neutralize the payload because the malicious script content is base64-encoded as plain alphanumeric text with no HTML tags to strip; the vcrawhtml shortcode template then decodes and echoes this content unescaped at render time.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WPBakery Page Builderto a version that resolves this vulnerability.Fixed in 8.7.4 - Compensating control
Since the issue affects all versions up to and including 8.7.4 and requires authenticated attackers with subscriber-level access or above, restrict/limit who has subscriber+ roles (e.g., reduce subscriber+ permissions) to reduce the ability to inject payloads.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the WordPress site with at least Subscriber-level access. They can inject a payload through the affected data parameter.
When does the injected script execute?
The stored script executes when a user accesses a page containing the injected content. The impact therefore depends on which users visit the affected page.
Why does the existing save-time sanitization not prevent exploitation?
The payload is base64-encoded as alphanumeric text, so wp_kses_post does not identify HTML tags to remove during saving. The vc_raw_html shortcode later decodes and outputs the content without escaping.
Which versions are affected?
All WPBakery Page Builder versions up to and including 8.7.4 are affected.