🦸 👻 Calling all superheroes and haunters! Introducing the Cybersecurity Month Spooktacular Haunt and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through November 11th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers, top-tier researchers earn automatic bonuses of between 10% to 120% for valid submissions, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

WPBakery Visual Composer

Wordfence Intelligence > Vulnerability Database > WordPress Plugins > WPBakery Visual Composer

Information

Software Type	Plugin
Software Slug	js_composer
Software Status	Active
Software Author	wpbakery
Software Website	wpbakery.com
Software Record Last Updated	May 2, 2024

7 Vulnerabilities

Submit a Vulnerability

WPBakery <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVE-2024-5708

Aug 5, 2024

Researcher: João Pedro Soares de Alcântara

WPBakery <= 7.7 - Authenticated (Author+) Local File Inclusion

8.8

CVE-2024-5709

Aug 5, 2024

Researcher: João Pedro Soares de Alcântara

WPBakery Page Builder <= 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via VC Single Image link attribute

6.4

CVE-2024-5265

Jun 12, 2024

Researcher: wesley (wcraft)

WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attribute

6.4

CVE-2024-1842

Apr 11, 2024

Researcher: Nikolas

WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute

6.4

CVE-2024-1841

Apr 11, 2024

Researcher: Nikolas

WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author

6.4

CVE-2024-1840

Apr 11, 2024

Researcher: Nikolas

WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute

6.4

CVE-2024-1805

Apr 11, 2024

Researcher: Nikolas

Title	Status	CVE ID	CVSS	Researchers	Date
WPBakery <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting	Patched	CVE-2024-5708	6.4	João Pedro Soares de Alcântara	August 5, 2024
WPBakery <= 7.7 - Authenticated (Author+) Local File Inclusion	Patched	CVE-2024-5709	8.8	João Pedro Soares de Alcântara	August 5, 2024
WPBakery Page Builder <= 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via VC Single Image link attribute	Patched	CVE-2024-5265	6.4	wesley (wcraft)	June 12, 2024
WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attribute	Patched	CVE-2024-1842	6.4	Nikolas	April 11, 2024
WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute	Patched	CVE-2024-1841	6.4	Nikolas	April 11, 2024
WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author	Patched	CVE-2024-1840	6.4	Nikolas	April 11, 2024
WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute	Patched	CVE-2024-1805	6.4	Nikolas	April 11, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation