CVE-2025-11161

Name of the Vulnerable Software and Affected Versions WPBakery Page Builder versions prior to 8.6.2

Description The WPBakery Page Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the vc custom heading shortcode. This is caused by inadequate restriction of permitted HTML tags and improper sanitization of user-supplied attributes within the font container parameter. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into posts. These scripts will execute when a user accesses an injected page using the vc custom heading shortcode with malicious tag and text attributes.

Recommendations Update WPBakery Page Builder to version 8.6.2 or later.