{"id":"CVE-2026-119165","kind":"vulnerability","aliases":["CVE-2026-119165"],"related":[],"title":"WPBakery Page Builder: stored XSS via display name lets subscribers run scripts","description":"The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name / nickname' parameter in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires that at least one public post attributed to the attacker's account be rendered through a Basic Grid using a Grid Builder template with the Post Author element configured to link to the post author; Author-level users can satisfy this precondition unassisted, while Subscribers depend on an administrator having assigned or published a post under their account.","summary":"WPBakery Page Builder for WordPress does not sanitize the display name / nickname field, so a logged-in subscriber can store script code that runs in other visitors' browsers. The script runs when a user opens a page that renders the injected name through a Basic Grid with the Post Author element linked.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","page-builder","wordpress","wpbakery"],"not_affected_if":["auth-required","no-basic-grid-post-author"],"how_to_check":"- Check the installed WPBakery Page Builder version in the WordPress plugins screen or `wp plugin get js_composer --field=version` if WP-CLI is available.\n- Confirm whether any Basic Grid with a Grid Builder template uses the Post Author element linked to the author.","fix":"- WPBakery Page Builder: versions up to and including `9.0.1` are affected; the sources do not state a fixed version.","status":"open","published_at":"2026-11-07T03:17:01+00:00","first_seen_at":"2026-11-07T03:45:32+00:00","triaged_at":"2026-11-07T03:47:53+00:00","updated_at":"2026-11-07T03:47:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T03:47:53Z","model":"claude-haiku-5-5","output":{"fix":"- WPBakery Page Builder: versions up to and including `9.0.1` are affected; the sources do not state a fixed version.","reach":"internet","title":"WPBakery Page Builder: stored XSS via display name lets subscribers run scripts","impact":"medium","summary":"WPBakery Page Builder for WordPress does not sanitize the display name / nickname field, so a logged-in subscriber can store script code that runs in other visitors' browsers. The script runs when a user opens a page that renders the injected name through a Basic Grid with the Post Author element linked.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpbakery","page-builder"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Scripts run in visitors' browsers, potentially hijacking admin sessions","analyst_note":"Confirm the fixed version and vendor advisory; the sources give only the affected range up to and including 9.0.1.","how_to_check":"- Check the installed WPBakery Page Builder version in the WordPress plugins screen or `wp plugin get js_composer --field=version` if WP-CLI is available.\n- Confirm whether any Basic Grid with a Grid Builder template uses the Post Author element linked to the author.","plain_action":"","needs_analyst":true,"not_affected_if":["no-basic-grid-post-author","auth-required"],"who_is_affected":"Sites running WPBakery Page Builder up to and including 9.0.1 where Basic Grid templates render the Post Author element linked to the author. Attackers need a subscriber-level account, and subscribers need an administrator to have assigned or published a post under their account. Sites that do not use WPBakery Basic Grids with that element are less exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000763,"input_tokens":4386,"output_tokens":648,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119165':15A,18A '-2026':14A,17A '9.0.1':106C 'access':126C,142C 'account':160C,207C 'administr':198C 'arbitrari':131C 'assign':200C 'attack':121C,158C 'attribut':155C 'authent':120C 'author':75B,175C,183C,185C 'author-level':184C 'basic':70B,165C 'browser':53B 'builder':3A,22B,27B,81C,170C 'code':47B 'configur':177C 'cross':90C 'cross-sit':89C 'cve':13A,16A 'depend':195C 'display':7A,34B,95C 'due':107C 'element':76B,176C 'escap':114C 'execut':138C,147C 'field':37B 'grid':71B,166C,169C 'includ':105C 'inject':66B,130C,144C 'input':110C 'insuffici':109C 'least':151C 'let':9A 'level':125C,186C 'link':77B,179C 'log':41B 'logged-in':40B 'make':116C 'name':8A,35B,67B,96C 'nicknam':36B,97C 'one':152C 'open':60B 'output':113C 'packag':19B 'page':2A,21B,26B,62B,80C,135C,145C 'page-build':20B 'paramet':98C 'plugin':82C 'possibl':118C 'post':74B,154C,174C,182C,204C 'precondit':191C 'public':153C 'publish':202C 'render':64B,162C 'requir':148C 'run':11A,49B,56B 'sanit':32B,111C 'satisfi':189C 'script':12A,46B,55B,92C,133C 'site':91C 'store':4A,45B,88C 'subscrib':10A,43B,124C,194C 'subscriber-level':123C 'success':146C 'templat':171C 'unassist':192C 'use':167C 'user':59B,141C,187C 'version':101C 'via':6A,93C 'visitor':52B 'vulner':86C 'web':132C 'whenev':139C 'wordpress':23B,29B,84C 'wpbakeri':1A,24B,25B,79C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Sites running WPBakery Page Builder up to and including 9.0.1 where Basic Grid templates render the Post Author element linked to the author. Attackers need a subscriber-level account, and subscribers need an administrator to have assigned or published a post under their account. Sites that do not use WPBakery Basic Grids with that element are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","pagebuilder","wordpress","wpbakery"],"campaign_type":null,"search_a":"'-119165':15A,18A '-2026':14A,17A 'builder':3A 'cve':13A,16A 'display':7A 'let':9A 'name':8A 'page':2A 'run':11A 'script':12A 'store':4A 'subscrib':10A 'via':6A 'wpbakeri':1A 'xss':5A","search_b":"'author':75B 'basic':70B 'browser':53B 'builder':22B,27B 'code':47B 'display':34B 'element':76B 'field':37B 'grid':71B 'inject':66B 'link':77B 'log':41B 'logged-in':40B 'name':35B,67B 'nicknam':36B 'open':60B 'packag':19B 'page':21B,26B,62B 'page-build':20B 'post':74B 'render':64B 'run':49B,56B 'sanit':32B 'script':46B,55B 'store':45B 'subscrib':43B 'user':59B 'visitor':52B 'wordpress':23B,29B 'wpbakeri':24B,25B","search_c":"'9.0.1':106C 'access':126C,142C 'account':160C,207C 'administr':198C 'arbitrari':131C 'assign':200C 'attack':121C,158C 'attribut':155C 'authent':120C 'author':175C,183C,185C 'author-level':184C 'basic':165C 'builder':81C,170C 'configur':177C 'cross':90C 'cross-sit':89C 'depend':195C 'display':95C 'due':107C 'element':176C 'escap':114C 'execut':138C,147C 'grid':166C,169C 'includ':105C 'inject':130C,144C 'input':110C 'insuffici':109C 'least':151C 'level':125C,186C 'link':179C 'make':116C 'name':96C 'nicknam':97C 'one':152C 'output':113C 'page':80C,135C,145C 'paramet':98C 'plugin':82C 'possibl':118C 'post':154C,174C,182C,204C 'precondit':191C 'public':153C 'publish':202C 'render':162C 'requir':148C 'sanit':111C 'satisfi':189C 'script':92C,133C 'site':91C 'store':88C 'subscrib':124C,194C 'subscriber-level':123C 'success':146C 'templat':171C 'unassist':192C 'use':167C 'user':141C,187C 'version':101C 'via':93C 'vulner':86C 'web':132C 'whenev':139C 'wordpress':84C 'wpbakeri':79C","first_public_at":"2026-11-07T03:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119165","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119165","severity":null,"published_at":"2026-11-07T03:17:01+00:00","modified_at":"2026-11-07T03:17:01+00:00","first_seen_at":"2026-11-07T03:45:32+00:00","fetched_at":"2026-11-07T03:45:32+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}