CVE-2025-10006
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-18

Last updated on: 2025-11-26

Assigner: Wordfence

Description
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rev_slider_vc' shortcode in all versions up to, and including, 8.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when RevSlider is also installed.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-18
Last Modified
2025-11-26
Generated
2026-06-16
AI Q&A
2025-10-18
EPSS Evaluated
2026-06-15
NVD
CVE-2025-10006
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wpbakery page_builder to 8.7 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

Immediate mitigation steps include updating the WPBakery Page Builder plugin to a version later than 8.6 where the vulnerability has been fixed, as detailed in the changelog covering versions 8.3 through 8.7.1. Additionally, ensure that the Revolution Slider plugin is either removed or updated, and restrict contributor-level access to trusted users to reduce risk. Applying the security fixes and sanitization improvements provided in the updates will mitigate the vulnerability. [1]

Detection Guidance

Detection of this vulnerability involves identifying the presence of the vulnerable WPBakery Page Builder plugin versions (up to 8.6) with the RevSlider plugin installed, and monitoring for suspicious stored cross-site scripting payloads in pages using the 'rev_slider_vc' shortcode. Specific commands are not provided in the available resources. Generally, detection may include scanning WordPress installations for plugin versions and reviewing page content for injected scripts, but no explicit commands are given. [1]

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the WPBakery Page Builder plugin for WordPress, specifically via the 'rev_slider_vc' shortcode. It occurs because the plugin does not properly sanitize and escape user-supplied attributes. Authenticated users with contributor-level access or higher can inject malicious scripts into pages, which then execute whenever those pages are viewed. This vulnerability requires that the Revolution Slider (RevSlider) plugin is also installed to be exploitable. [1]

Impact Analysis

This vulnerability can allow attackers with contributor-level access or above to inject arbitrary JavaScript into pages, which will execute in the context of users viewing those pages. This can lead to unauthorized actions such as stealing session cookies, defacing content, or performing actions on behalf of other users without their consent. Since the attack is stored, the malicious script persists and affects all users who access the infected page, potentially compromising site security and user data. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-10006. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart