CVE-2026-81429

Name of the Vulnerable Software and Affected Versions Export & Import WPBakery Page Builder versions prior to 1.0.3

Description The template-import feature lacks Cross-Site Request Forgery (CSRF) checks and fails to sanitize imported data before storage and output. This allows an attacker to trick a logged-in administrator into importing a crafted template through a forged request, leading to Stored Cross-Site Scripting (XSS) within the administrator's session. CSRF is a flaw that allows an attacker to induce a user to perform actions they did not intend to take, while Stored XSS occurs when a malicious script is permanently stored on the target server.

Recommendations Update Export & Import WPBakery Page Builder to version 1.0.3 or later.