Stored Cross-Site Scripting Vulnerability in WPBakery Page Builder Plugin

CVE-2026-119165

What is CVE-2026-119165?

The WPBakery Page Builder plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping. This issue affects all versions up to and including 9.0.1. Authenticated attackers with subscriber-level access or higher can exploit this vulnerability by injecting malicious web scripts through the 'display_name / nickname' parameter. This allows the scripts to execute when other users access pages that include the attacker’s content, particularly through a Basic Grid display that incorporates the Post Author element. Effective mitigation requires strict user role management and careful input validation.

References