CVE-2026-81429: CWE-79 Cross-Site Scripting (XSS) in Export & Import WPBakery Page Builder
The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via a forged request that results in Stored Cross-Site Scripting executed in the administrator's session.
AI Analysis
Technical Summary
The Export & Import WPBakery Page Builder WordPress plugin versions up to 1.0.2 do not perform Cross-Site Request Forgery (CSRF) checks on the template-import feature and fail to sanitize imported data. This combination enables an attacker to trick an authenticated administrator into importing a malicious template through a forged request, resulting in stored Cross-Site Scripting (CWE-79) that executes in the administrator's session. The vulnerability also involves CWE-352 due to the missing CSRF protection.
Potential Impact
An attacker can execute arbitrary JavaScript in the context of an administrator's session by causing the administrator to import a crafted template. This can lead to session hijacking, privilege escalation, or other malicious actions performed with administrator privileges within the WordPress environment.
Mitigation Recommendations
No official patch or fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid importing templates from untrusted sources and restrict access to the template-import feature to trusted users only.
CVE-2026-81429: CWE-79 Cross-Site Scripting (XSS) in Export & Import WPBakery Page Builder
Description
The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via a forged request that results in Stored Cross-Site Scripting executed in the administrator's session.
CVSS v3.1
Score 7.1high
Affected software
Export & Import WPBakery Page Builder
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Export & Import WPBakery Page Builder WordPress plugin versions up to 1.0.2 do not perform Cross-Site Request Forgery (CSRF) checks on the template-import feature and fail to sanitize imported data. This combination enables an attacker to trick an authenticated administrator into importing a malicious template through a forged request, resulting in stored Cross-Site Scripting (CWE-79) that executes in the administrator's session. The vulnerability also involves CWE-352 due to the missing CSRF protection.
Potential Impact
An attacker can execute arbitrary JavaScript in the context of an administrator's session by causing the administrator to import a crafted template. This can lead to session hijacking, privilege escalation, or other malicious actions performed with administrator privileges within the WordPress environment.
Mitigation Recommendations
No official patch or fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid importing templates from untrusted sources and restrict access to the template-import feature to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-26T19:14:02.643Z
- State
- PUBLISHED
Threat ID: 6aa4ee6155bf5e2cf5f21fe5
Added to database: 09/12/2026, 06:17:05 UTC
Last enriched: 09/12/2026, 06:48:00 UTC
Last updated: 09/13/2026, 02:05:44 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.