# WPBakery Page Builder. Every CVE that names WPBakery Page Builder among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name](https://agentprime.io/advisories/CVE-2026-119165.md) `CVE-2026-119165` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 7 Nov 2026 · Tags: Cross-site scripting (XSS) - [WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter](https://agentprime.io/advisories/CVE-2026-15101.md) `CVE-2026-15101` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [WPBakery Page Builder <= 8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-10006.md) `CVE-2025-10006` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 18 Oct 2025 · Tags: Cross-site scripting (XSS) - [WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via Custom JS Module](https://agentprime.io/advisories/CVE-2025-11160.md) `CVE-2025-11160` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 15 Oct 2025 · Tags: Cross-site scripting (XSS) - [WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via vc_custom_heading Shortcode](https://agentprime.io/advisories/CVE-2025-11161.md) `CVE-2025-11161` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 15 Oct 2025 · Tags: Cross-site scripting (XSS) - [WPBakery Page Builder for WordPress <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-7502.md) `CVE-2025-7502` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: Cross-site scripting (XSS) - [WPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements](https://agentprime.io/advisories/CVE-2025-4968.md) `CVE-2025-4968` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 24 Jul 2025 · Tags: Cross-site scripting (XSS) - [WPBakery Page Builder <= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder](https://agentprime.io/advisories/CVE-2025-4965.md) `CVE-2025-4965` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 19 Jun 2025 · Tags: Cross-site scripting (XSS) - [WPBakery <= 7.7 - Authenticated (Author+) Local File Inclusion](https://agentprime.io/advisories/CVE-2024-5709.md) `CVE-2024-5709` · CVE record: wpbakery WPBakery Page Builder · CVSS 8.8 High · Not analysed yet · Published 6 Aug 2024 · Tags: Path traversal - [WPBakery <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-5708.md) `CVE-2024-5708` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 6 Aug 2024 · Tags: Cross-site scripting (XSS) - [WPBakery Page Builder <= 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via VC Single Image link attribute](https://agentprime.io/advisories/CVE-2024-5265.md) `CVE-2024-5265` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 13 Jun 2024 · Tags: Cross-site scripting (XSS) - [WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author](https://agentprime.io/advisories/CVE-2024-1840.md) `CVE-2024-1840` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 2 May 2024 · Tags: Cross-site scripting (XSS) - [WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute](https://agentprime.io/advisories/CVE-2024-1805.md) `CVE-2024-1805` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 2 May 2024 · Tags: Cross-site scripting (XSS) - [WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attribute](https://agentprime.io/advisories/CVE-2024-1842.md) `CVE-2024-1842` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 2 May 2024 · Tags: Cross-site scripting (XSS) - [WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute](https://agentprime.io/advisories/CVE-2024-1841.md) `CVE-2024-1841` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 2 May 2024 · Tags: Cross-site scripting (XSS) - [WordPress WPBakery Page Builder Plugin < 6.13.0 is vulnerable to Cross Site Scripting (XSS)](https://agentprime.io/advisories/CVE-2023-31213.md) `CVE-2023-31213` · CVE record: WPBakery WPBakery Page Builder · CVSS 6.5 Medium · Not analysed yet · Published 22 Jun 2023 · Tags: Cross-site scripting (XSS) ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .