Stored Cross-Site Scripting Vulnerability in WPBakery Page Builder for WordPress
CVE-2025-4965
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 19 June 2025
What is CVE-2025-4965?
The WPBakery Page Builder plugin for WordPress has a vulnerability that allows authenticated users with author-level access to inject malicious scripts through the Grid Builder feature. This issue arises from inadequate input sanitization and output escaping of user-supplied attributes, enabling attackers to execute scripts on pages viewed by other users. As a result, attackers can compromise the integrity of user sessions and potentially manipulate website content.
Affected Version(s)
WPBakery Page Builder for WordPress * <= 8.4.1