CVE-2026-15101

Name of the Vulnerable Software and Affected Versions WPBakery Page Builder versions prior to 8.7.5

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. By using the data parameter, an attacker can inject arbitrary web scripts into pages. The issue occurs because the wp kses post sanitization function fails to neutralize base64-encoded payloads, which are then decoded and rendered unescaped by the vc raw html shortcode template.

Recommendations Update the plugin to version 8.7.5 or later.