How severe is CVE-2025-11160?

CVE-2025-11160 has a CVSS 3.x base score of 6.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-11160 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-11160?

CVE-2025-11160 affects Wpbakery Page Builder. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-11160?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-11160 have an EU (EUVD) identifier?

Yes. CVE-2025-11160 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-34532.

When was CVE-2025-11160 published?

CVE-2025-11160 was published on 2025-10-15 and last updated on 2026-06-17.

CVE-2025-11160

CVE-2025-11160 is a medium-severity vulnerability in Wpbakery Page Builder with a CVSS 3.x base score of 6.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-80.

Key facts

Severity: Medium (CVSS 3.x base score 6.4)
EPSS exploit prediction: 0% (9th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-34532
Weakness: CWE-80
Affected product: Wpbakery Page Builder
Published: 2025-10-15
Last modified: 2026-06-17

Description

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1. This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS module. This makes it possible for authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the WPBakery Page Builder Custom JS module granted they have access to the WPBakery editor for post types.

Frequently asked questions

What is CVE-2025-11160?: The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1. This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS module. This makes it possible for authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the WPBakery Page Builder Custom JS module granted they have access to the WPBakery editor for post types.
How severe is CVE-2025-11160?: CVE-2025-11160 has a CVSS 3.x base score of 6.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-11160 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-11160?: CVE-2025-11160 affects Wpbakery Page Builder. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-11160?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-11160 have an EU (EUVD) identifier?: Yes. CVE-2025-11160 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-34532.
When was CVE-2025-11160 published?: CVE-2025-11160 was published on 2025-10-15 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:wpbakery:page_builder:*:*:*:*:*:wordpress:*:*

More vulnerabilities in Wpbakery Page Builder

CVE-2024-5709 — High (CVSS 8.8): The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and…
CVE-2024-43953 — Medium (CVSS 6.5): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcodingplace…
CVE-2023-31213 — Medium (CVSS 6.5): Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPBakery Page Builder plugin <= 6.13.0…
CVE-2025-10006 — Medium (CVSS 6.4): The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's…
CVE-2025-11161 — Medium (CVSS 6.4): The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_custom_heading…
CVE-2025-7502 — Medium (CVSS 6.4): The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several…

All CVEs affecting Wpbakery Page Builder →

Other CWE-80 vulnerabilities

CVE-2024-39363 — Critical (CVSS 9.6): A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wavlink…
CVE-2023-39216 — Critical (CVSS 9.6): Improper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable…
CVE-2025-53883 — Critical (CVSS 9.3): A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run…
CVE-2026-32891 — Critical (CVSS 9.0): Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media…
CVE-2026-57532 — High (CVSS 8.8): Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF…
CVE-2026-6002 — High (CVSS 8.8): Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in DivvyDrive Information…

Browse all CWE-80 vulnerabilities →