Stored Cross-Site Scripting in WPBakery Page Builder for WordPress

CVE-2026-15101

What is CVE-2026-15101?

The WPBakery Page Builder plugin for WordPress contains a vulnerability that allows authenticated attackers with subscriber-level access and higher to exploit stored cross-site scripting (XSS). This occurs through the 'data' parameter, which suffers from inadequate input sanitization and output escaping. Attackers can inject arbitrary web scripts that execute whenever an unsuspecting user visits an affected page. The issue stems from the wp_kses_post sanitization not neutralizing the payload due to it being base64-encoded without HTML tags. Consequently, the vc_raw_html shortcode template decodes and renders the unsafe content, leaving users vulnerable to attacks.

References