Log in Start free

WPBakery

Products

ProductCVEsExploitedLatest
WPBakery Page Builder16–Nov 7, 2026
Templatera1–Aug 14, 2025

Exploited and recent CVEs

  • CVE-2026-119165 Medium 6.4 WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name –
  • CVE-2026-15101 Medium 6.4 WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter 0.3%
  • CVE-2025-10006 Medium 6.4 WPBakery Page Builder <= 8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
  • CVE-2025-11160 Medium 6.4 WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via Custom JS Module 0.2%
  • CVE-2025-11161 Medium 6.4 WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via vc_custom_heading Shortcode 0.2%
  • CVE-2025-54747 Medium 6.5 WordPress Templatera Plugin <= 2.3.0 - Cross Site Scripting (XSS) Vulnerability 0.2%
  • CVE-2025-7502 Medium 6.4 WPBakery Page Builder for WordPress <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
  • CVE-2025-4968 Medium 6.4 WPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements 0.3%
  • CVE-2025-4965 Medium 6.4 WPBakery Page Builder <= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder 0.2%
  • CVE-2024-5709 High 8.8 WPBakery <= 7.7 - Authenticated (Author+) Local File Inclusion 1.0%
  • CVE-2024-5708 Medium 6.4 WPBakery <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting 0.3%
  • CVE-2024-5265 Medium 6.4 WPBakery Page Builder <= 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via VC Single Image link attribute 0.3%
  • CVE-2024-1840 Medium 6.4 WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author 0.3%
  • CVE-2024-1805 Medium 6.4 WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute 0.3%
  • CVE-2024-1842 Medium 6.4 WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attribute 0.3%
  • CVE-2024-1841 Medium 6.4 WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute 0.3%
  • CVE-2023-31213 Medium 6.5 WordPress WPBakery Page Builder Plugin < 6.13.0 is vulnerable to Cross Site Scripting (XSS) 0.4%