Stored Cross-Site Scripting in WPBakery Page Builder Affects WordPress Users
CVE-2025-10006
6.4MEDIUM
What is CVE-2025-10006?
The WPBakery Page Builder plugin for WordPress has a vulnerability that allows stored cross-site scripting through its 'rev_slider_vc' shortcode. This issue affects all versions up to and including 8.6 due to inadequate input sanitization and output escaping on attributes provided by users. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages, which will execute whenever the targeted page is accessed by users. The exploit is contingent upon the RevSlider plugin being installed, potentially compromising site security and user data.
Affected Version(s)
WPBakery Page Builder * <= 8.6