VendorsWPBakerypage_builderall versions
Vulnerabilities

WPBakery Page Builder

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

14CVEs
CVE-2024-5709
WPBakery <= 7.7 - Authenticated (Author+) Local File Inclusion
Published 2024-08-06 · Analyzed
8.8EPSS 0.010
CVE-2023-31213
WordPress WPBakery Page Builder Plugin < 6.13.0 is vulnerable to Cross Site Scripting (XSS)
Published 2023-06-22 · Modified
6.5EPSS 0.004
CVE-2024-43953
WordPress Classic Addons – WPBakery Page Builder plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability
Published 2024-08-29 · Modified
6.5EPSS 0.003
CVE-2020-28650
The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles.
Published 2020-11-16 · Modified
6.4EPSS 0.007
CVE-2024-1805
WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute
Published 2024-05-02 · Modified
6.4EPSS 0.003
CVE-2024-1840
WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author
Published 2024-05-02 · Modified
6.4EPSS 0.003
CVE-2024-1841
WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute
Published 2024-05-02 · Modified
6.4EPSS 0.003
CVE-2024-1842
WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attribute
Published 2024-05-02 · Modified
6.4EPSS 0.003
CVE-2025-4968
WPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements
Published 2025-07-24 · Analyzed
6.4EPSS 0.003
CVE-2025-10006
WPBakery Page Builder <= 8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published 2025-10-18 · Analyzed
6.4EPSS 0.002
CVE-2025-7502
WPBakery Page Builder for WordPress <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published 2025-08-06 · Analyzed
6.4EPSS 0.002
CVE-2025-11160
WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via Custom JS Module
Published 2025-10-15 · Analyzed
6.4EPSS 0.002
CVE-2025-11161
WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via vc_custom_heading Shortcode
Published 2025-10-15 · Analyzed
6.4EPSS 0.002
CVE-2025-4965
WPBakery Page Builder <= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder
Published 2025-06-19 · Analyzed
6.4EPSS 0.002