CVE-2025-4968

Executive Summary

CVE-2025-4968 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WPBakery Page Builder plugin for WordPress, versions up to and including 8.4.1. The vulnerability resides in multiple Page Builder elements, including the Copyright Element, Hover Box, Separator With Text, FAQ, Single Image, Custom Header, Button, Call To Action, Progress Bar, Pie Chart, Round Chart, and Line Chart. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, leading to potential session hijacking, data theft, or defacement.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the WPBakery Page Builder plugin. The plugin is distributed via the WordPress plugin repository and commercial channels. No supply chain compromise has been identified, but the lack of a patch increases risk for all users of the affected versions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction for script execution. The vulnerability is exploitable by authenticated users with minimal permissions, making it a significant risk for multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability stems from improper handling of user-supplied attributes in multiple WPBakery Page Builder elements. When a contributor or higher-level user creates or edits a page using these elements, the plugin fails to sanitize and escape attribute values before rendering them in the HTML output. This allows an attacker to inject malicious JavaScript code into attributes such as title, alt, href, or custom data attributes.

The injected script is stored in the WordPress database and executed in the browser of any user viewing the affected page. Since the vulnerability affects multiple elements, the attack surface is broad. The lack of output escaping means that even if the input is stored safely, the rendering process does not neutralize the malicious payload.

Vulnerable vs. Patched Code

Vulnerable Code (Example from Copyright Element):

// In wpbakerys element render function
$output = '<div class="copyright-element" data-copyright="' . $atts['copyright_text'] . '">' . $content . '</div>';

Here, $atts['copyright_text'] is directly concatenated without escaping.

Patched Code (Hypothetical):

// Patched version
$output = '<div class="copyright-element" data-copyright="' . esc_attr($atts['copyright_text']) . '">' . esc_html($content) . '</div>';

The patched code uses esc_attr() for attribute values and esc_html() for HTML content, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WPBakery Page Builder <= 8.4.1
• Contributor-level account or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new page or edit an existing one.
3. Add a vulnerable element (e.g., Copyright Element).
4. In the element's attribute field (e.g., "Copyright Text"), inject the following payload:

   "><script>alert('XSS')</script>
   

5. Save and publish the page.
6. When any user visits the page, the script executes.

Advanced Payload:

" onmouseover="alert(document.cookie)

This triggers on mouse hover, bypassing some filters.

Blue Team

Detection:

• Monitor for unusual attribute values in page content.
• Use WAF rules to block common XSS patterns.
• Review user activity logs for suspicious page edits.

Mitigation:

• Disable the vulnerable elements until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• Network: HTTP requests to pages containing injected scripts.
• File: Modified WordPress posts/pages in the database with malicious JavaScript in element attributes.
• Logs: User activity logs showing edits to pages using vulnerable elements with unusual attribute values.
• Memory: Browser-side execution of injected scripts (visible in developer tools).

Detection Engineering

YARA Rule

rule CVE_2025_4968_WPBakery_XSS {
    meta:
        description = "Detects stored XSS payloads in WPBakery Page Builder elements"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-4968"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*["'][^"']*["']/i
        $xss3 = /javascript\s*:/i
    condition:
        any of ($xss*) and (
            //wp-content/plugins/js_composer/ in filename or
            //wp-content/plugins/wpbakery/ in filename
        )
}

Sigma Rule

title: CVE-2025-4968 WPBakery Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WPBakery Page Builder elements
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'vc_editable'
            - 'wpbakery'
        cs-uri-query|re: '(<script|on\w+=|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4968 WPBakery Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wpbakery"; http_uri; pcre:"/(<script|on\w+=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Vulnerable Elements: Temporarily disable the affected elements (Copyright, Hover Box, etc.) via the plugin settings or by removing their shortcodes.
2. Restrict User Roles: Limit contributor-level access to only trusted users. Consider using a plugin to restrict editing capabilities.
3. Web Application Firewall (WAF): Deploy WAF rules to block common XSS patterns in POST requests to WordPress admin pages.

Long-term Fix:

• Patch: Await an official patch from WPBakery. Monitor their changelog for version 8.4.2 or higher.
• Update: Once patched, update the plugin immediately.
• Code Review: If you have custom code, ensure all user inputs are sanitized with esc_attr() and esc_html().

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert