WPBakery Page Builder for WordPress <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE CVE-2020-28650
CVSS Medium (6.4)
Publicly Published October 7, 2020
Last Updated July 15, 2025
Researcher Chloe Chamberland
Description

The WPBakery plugin for WordPress, in versions 6.4 and below, was designed with a flaw that could give users with contributor and author level roles the ability to inject malicious JavaScript into pages and posts. This flaw also gave these users the ability to edit other users’ posts. The plugin explicitly disabled any default post HTML filtering checks in the saveAjaxFe function using kses_remove_filters();. This meant that any user with access to the WPBakery builder could inject HTML and JavaScript anywhere in a post using the page builder.

References

1 affected software package

Software Type Plugin
Software Slug js_composer (view on wordpress.org)
Patched? Yes
Affected Version
  • <= 6.4
Patched Version
  • 6.4.1
This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.
License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. License Detail.