WordPress Plugin Vulnerabilities

Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF

Description

The plugin does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via a forged request that results in Stored Cross-Site Scripting executed in the administrator's session.

Proof of Concept

Affects Plugins

Plugin icon
vc-templates-import-export
No known fix

References

CVE
CVE-2026-81429

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Suhayb Ahmed (cyboltx)
Submitter
Suhayb Ahmed (cyboltx)
Verified
Yes
WPVDB ID
48f67510-9fb3-4f74-a38e-31635617ba60

Timeline

Publicly Published
2026-09-10 (about 2 days ago)
Added
2026-09-10 (about 1 day ago)
Last Updated
2026-09-10 (about 1 day ago)

Other

Published
Title
Published
2024-08-30
Title
WPZOOM Portfolio Lite – Filterable Portfolio Plugin < 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute
Published
2023-11-23
Title
Video Player <= 1.5.22 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2015-06-05
Title
Ninja Forms <= 2.9.18 - Cross-Site Scripting (XSS)
Published
2022-04-02
Title
ULeak Security & Monitoring <= 1.2.3 - Subscriber+ Stored Cross-Site Scripting
Published
2025-01-13
Title
Bold pagos en linea < 3.1.5 - Reflected Cross-Site Scripting