Security Advisory

CVE-2026-81429

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-12 06:00:09

Last updated 2026-09-12 15:33:38

Assigner WPScan

CVSS score 7.1

State PUBLISHED

Description

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via a forged request that results in Stored Cross-Site Scripting executed in the administrator's session.

← Browse all CVEs View on cve.org ↗