CVE-2026-81429
Received Received - Intake

Stored XSS in WPBakery Page Builder WordPress Plugin

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: WPScan

Description
The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via a forged request that results in Stored Cross-Site Scripting executed in the administrator's session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-81429
EUVD
EUVD-2026-76785

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpbakery vc_templates_import_export to 1.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Export & Import WPBakery Page Builder WordPress plugin through version 1.0.2. It occurs because the plugin lacks CSRF protection on its template-import feature and does not sanitize imported data before storing and displaying it. Attackers can exploit this by tricking a logged-in administrator into importing a malicious template via a forged request, leading to Stored XSS execution in the administrator's session.

Detection Guidance

Check if the Export & Import WPBakery Page Builder plugin version 1.0.2 or below is installed. Inspect network traffic for unauthorized POST requests to the template-import feature. Look for unusual JavaScript execution in admin sessions.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the context of an administrator's session. This could lead to unauthorized actions being performed on the WordPress site, theft of sensitive data, or further compromise of the site's security. Administrators should update the plugin immediately to mitigate this risk.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements such as GDPR or HIPAA. Stored XSS attacks can result in the theft of personal or sensitive data, leading to potential legal and financial penalties for non-compliance.

Mitigation Strategies

Update the plugin to the latest version immediately. Disable the template-import feature if not required. Implement CSRF protection on all forms. Monitor admin sessions for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81429. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart