Stored Cross-Site Scripting in WPBakery Page Builder Affects WordPress Users

CVE-2025-10006

What is CVE-2025-10006?

The WPBakery Page Builder plugin for WordPress has a vulnerability that allows stored cross-site scripting through its 'rev_slider_vc' shortcode. This issue affects all versions up to and including 8.6 due to inadequate input sanitization and output escaping on attributes provided by users. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages, which will execute whenever the targeted page is accessed by users. The exploit is contingent upon the RevSlider plugin being installed, potentially compromising site security and user data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References