Vulnerability · Published Nov 7, 2026 · Assigned by Wordfence
CVE-2026-119165WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name
Medium 6.4
In plain English
A medium-severity cross-site scripting in WPBakery Page Builder from wpbakery. There are no confirmed reports of exploitation so far.
Official description
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name / nickname' parameter in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires that at least one public post attributed to the attacker's account be rendered through a Basic Grid using a Grid Builder template with the Post Author element configured to link to the post author; Author-level users can satisfy this precondition unassisted, while Subscribers depend on an administrator having assigned or published a post under their account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wpbakery | WPBakery Page Builder | 0 – through 9.0.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N