CVE-2026-81429: Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF

Q: What must an attacker do to exploit this issue?

The attacker must cause a logged-in WordPress administrator to submit a forged request to the plugin's template-import feature. The forged import must contain a crafted template payload.

Q: Who is exposed to the stored script execution?

Logged-in administrators are the stated execution context. A successful forged import stores the crafted data, and the script is executed in the administrator's session when that data is echoed back.

Q: How can I determine whether my site is affected?

Sites using the Export & Import WPBakery Page Builder plugin version 1.0.2 or earlier are affected according to the available information. Review whether the plugin is installed and whether its template-import feature is available to administrators.

Published Sep 12, 2026

Updated

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via a forged request that results in Stored Cross-Site Scripting executed in the administrator's session.

Affected Software

1 affected component

WPBakery Page Builder (Export & Import)<=1.0.2

Event History

Sep 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must cause a logged-in WordPress administrator to submit a forged request to the plugin's template-import feature. The forged import must contain a crafted template payload.

Who is exposed to the stored script execution?

Logged-in administrators are the stated execution context. A successful forged import stores the crafted data, and the script is executed in the administrator's session when that data is echoed back.

How can I determine whether my site is affected?

Sites using the Export & Import WPBakery Page Builder plugin version 1.0.2 or earlier are affected according to the available information. Review whether the plugin is installed and whether its template-import feature is available to administrators.