CVE-2026-119165

Name of the Vulnerable Software and Affected Versions WPBakery Page Builder versions prior to 9.0.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts via the display name / nickname parameter. These scripts execute when a user accesses a page where a public post attributed to the attacker is rendered through a Basic Grid using a Grid Builder template with the Post Author element configured to link to the post author.

Recommendations Update WPBakery Page Builder to version 9.0.2 or later.