CVE-2025-4968
📋 TL;DR
This vulnerability allows authenticated attackers with contributor-level access or higher to inject malicious scripts into WordPress pages using WPBakery Page Builder elements. The scripts execute when users view the compromised pages, enabling cross-site scripting attacks. All WordPress sites using WPBakery Page Builder versions up to 8.4.1 are affected.
💻 Affected Systems
- WPBakery Page Builder for WordPress
📦 What is this software?
Page Builder by Wpbakery
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, hijack user sessions, redirect visitors to malicious sites, or deface websites, potentially leading to complete site compromise and data theft.
Likely Case
Attackers with contributor access inject malicious scripts to steal user cookies, session tokens, or redirect users to phishing pages, compromising user accounts and site integrity.
If Mitigated
With proper access controls and input validation, impact is limited to low-privilege user account compromise and minor site defacement.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once attacker has contributor-level credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.4.2 or later
Vendor Advisory: https://kb.wpbakery.com/docs/preface/release-notes/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WPBakery Page Builder. 4. Click 'Update Now' if update available. 5. Alternatively, download latest version from WordPress repository and manually update.
🔧 Temporary Workarounds
Restrict User Roles
allTemporarily restrict contributor-level access or implement additional approval workflows for content changes.
Content Security Policy
allImplement strict CSP headers to mitigate XSS impact by restricting script execution sources.
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads in POST requests
- Disable WPBakery Page Builder plugin temporarily until patching is possible
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for WPBakery Page Builder version. If version is 8.4.1 or lower, system is vulnerable.Check Version:
wp plugin list --name=js_composer --field=versionVerify Fix Applied:
After updating, verify WPBakery Page Builder version shows 8.4.2 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to wp-admin/admin-ajax.php with script tags in parameters
- Multiple page edits by contributor-level users in short timeframe
Network Indicators:
- Inbound requests containing script payloads in POST data to WordPress endpoints
SIEM Query:
source="wordpress.log" AND ("admin-ajax.php" OR "wp-admin/post.php") AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")