The WPBakery Page Builder plugin for WordPress contains a stored XSS vulnerability (CWE-80) via the vc_custom_heading shortcode. This occurs because the plugin does not properly restrict allowed HTML tags or sanitize user input in the font_container parameter. As a result, authenticated users with contributor or higher privileges can inject arbitrary JavaScript that executes when other users view the affected content. This vulnerability affects all versions up to 8.6.1. No official patch or fix information is provided in the available data.

Successful exploitation allows an authenticated contributor or higher to inject malicious scripts into posts, potentially leading to session hijacking, defacement, or other script-based attacks when other users access the affected pages. The impact is limited to users who can authenticate with contributor-level privileges or above. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the vc_custom_heading shortcode. Monitor vendor channels for updates and apply official patches once released.