Plugin icon

WPBakery Page Builder

js_composer

Vulnerabilities:

16

Last Updated:

October 28, 2025

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2025-10-17
Title
WPBakery Page Builder < 8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 8.7
CVSS
6.4 (medium)
Published
2025-10-14
Title
WPBakery Page Builder < 8.7 - Stored Cross-Site Scripting via vc_custom_heading Shortcode
Fixed in
Fixed in 8.7
CVSS
6.4 (medium)
Published
2025-10-14
Title
WPBakery Page Builder < 8.7 - Stored Cross-Site Scripting via Custom JS Module
Fixed in
Fixed in 8.7
CVSS
6.4 (medium)
Published
2025-08-05
Title
WPBakery Page Builder for WordPress < 8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 8.6
CVSS
6.4 (medium)
Published
2025-07-23
Title
WPBakery Page Builder < 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements
Fixed in
Fixed in 8.5
CVSS
6.4 (medium)
Published
2025-06-18
Title
WPBakery Page Builder < 8.5 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder
Fixed in
Fixed in 8.5
CVSS
6.4 (medium)
Published
2024-08-05
Title
WPBakery < 7.8 - Authenticated (Author+) Local File Inclusion
Fixed in
Fixed in 7.8
CVSS
8.8 (high)
Published
2024-08-05
Title
WPBakery < 7.8 - Authenticated (Author+) Stored Cross-Site Scripting
Fixed in
Fixed in 7.8
CVSS
6.4 (medium)
Published
2024-06-12
Title
WPBakery Page Builder < 7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via VC Single Image link attribute
Fixed in
Fixed in 7.7
CVSS
6.4 (medium)
Published
2024-04-11
Title
WPBakery Visual Composer < 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute
Fixed in
Fixed in 7.6
CVSS
6.4 (medium)
Published
2024-04-11
Title
WPBakery Visual Composer < 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute
Fixed in
Fixed in 7.6
CVSS
6.4 (medium)
Published
2024-04-11
Title
WPBakery Visual Composer < 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attribute
Fixed in
Fixed in 7.6
CVSS
6.4 (medium)
Published
2024-04-11
Title
WPBakery Visual Composer < 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author
Fixed in
Fixed in 7.6
CVSS
6.4 (medium)
Published
2023-06-22
Title
WPBakery Page Builder < 6.13.0 - Contributor+ Stored XSS
Fixed in
Fixed in 6.13.0
CVSS
6.8 (medium)
Published
2020-10-07
Title
WPBakery Page Builder < 6.4.1 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 6.4.1
CVSS
6.4 (medium)
Published
2015-10-09
Title
WPBakery Page Builder < 4.7.4 - Multiple Unspecified Cross-Site Scripting (XSS)
Fixed in
Fixed in 4.7.4
CVSS
5.4 (medium)