https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-10006.htmlhttps://patchthecve.com/cve/CVE-2025-10006.htmlFri, 09 Oct 2026 10:10:00 +0000MEDIUM 6.4: The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rev_slider_vc' shortcode in all versions up to, and including, 8.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentihttps://patchthecve.com/cve/CVE-2025-11161.htmlhttps://patchthecve.com/cve/CVE-2025-11161.htmlThu, 08 Oct 2026 12:10:00 +0000MEDIUM 6.4: The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_custom_heading shortcode in all versions up to, and including, 8.6.1. This is due to insufficient restriction of allowed HTML tags and improper sanitization of user-supplied attributes in the font_https://patchthecve.com/cve/CVE-2025-11160.htmlhttps://patchthecve.com/cve/CVE-2025-11160.htmlThu, 08 Oct 2026 12:10:00 +0000MEDIUM 6.4: The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1. This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS module. This makes ithttps://patchthecve.com/cve/CVE-2025-7502.htmlhttps://patchthecve.com/cve/CVE-2025-7502.htmlWed, 17 Jun 2026 10:05:05 +0000MEDIUM 6.4: The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several shortcodes in all versions up to, and including, 8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated https://patchthecve.com/cve/CVE-2025-4968.htmlhttps://patchthecve.com/cve/CVE-2025-4968.htmlWed, 17 Jun 2026 09:34:24 +0000MEDIUM 6.4: The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Page Builder elements (Copyright Element, Hover Box, Separator With Text, FAQ, Single Image, Custom Header, Button, Call To Action, Progress Bar, Pie Chart, Round Chart, and Line Chttps://patchthecve.com/cve/CVE-2024-43953.htmlhttps://patchthecve.com/cve/CVE-2024-43953.htmlWed, 17 Jun 2026 07:52:03 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder classic-addons-wpbakery-page-builder-addons allows Stored XSS.This issue affects Classic Addons – WPBakery Page Builder: from n/a through <= 3.5https://patchthecve.com/cve/CVE-2024-5709.htmlhttps://patchthecve.com/cve/CVE-2024-5709.htmlWed, 17 Jun 2026 08:16:29 +0000HIGH 8.8: The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the 'layout_name' parameter. This makes it possible for authenticated attackers, with Author-level access and above, and with post permissions granted by an Administrhttps://patchthecve.com/cve/CVE-2024-5708.htmlhttps://patchthecve.com/cve/CVE-2024-5708.htmlWed, 17 Jun 2026 08:16:29 +0000MEDIUM 6.4: The WPBakery Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a