Stored Cross-Site Scripting in WPBakery Page Builder Plugin

CVE-2025-11161

What is CVE-2025-11161?

The WPBakery Page Builder plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability through the vc_custom_heading shortcode present in versions up to and including 8.6.1. This vulnerability arises from inadequate restrictions on allowed HTML tags and improper sanitization of user-supplied attributes within the font_container parameter. As a result, authenticated attackers with contributor-level access or higher can inject malicious web scripts into posts. These scripts will execute when users access a page containing these injected scripts via the vc_custom_heading shortcode, posing a significant risk to the site's security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References