WPBakery

Vulnerabilities 18Slug js-composerLatest version 6.9.0Plugin page →

Minimum safe version

8.7

Update to 8.7 or later to address 18 fixable vulnerabilities

Latest available6.9.0 ✗

Medium 5.4

2025-10-18< 8.7

CVE-2025-10006

CVE EUVD Wordfence

Medium 5.4

2025-10-15< 8.7

CVE-2025-11160

CVE Wordfence

Medium 6.4

2025-10-15< 8.7

CVE-2025-11161

CVE Wordfence

Medium 6.4

2025-08-06< 8.6

WPBakery Page Builder for WordPress <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

EUVD Wordfence CVE

Medium 6.4

2025-07-24< 8.5

WPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements

EUVD Wordfence CVE

Medium 6.4

2025-06-19< 8.5

WordPress WPBakery Page Builder Plugin <= 8.4.1 is vulnerable to Cross Site Scripting (XSS)

Patchstack EUVD Wordfence CVE

High 8.8

2024-08-06< 7.8

CVE-2024-5709

CVE Patchstack Wordfence

Medium 5.4

2024-08-06< 7.8

CVE-2024-5708

CVE Patchstack Wordfence

Medium 5.4

2024-06-13< 7.7

CVE-2024-5265

CVE Wordfence

Medium 5.4

2024-05-02< 7.6

CVE-2024-1842

CVE Wordfence

Medium 5.4

2024-05-02< 7.6

CVE-2024-1841

CVE Wordfence

Medium 5.4

2024-05-02< 7.6

CVE-2024-1840

CVE Patchstack Wordfence

Medium 5.4

2024-05-02< 7.6

CVE-2024-1805

CVE Patchstack Wordfence

Medium 6.5

2023-06-22< 6.13.0

CVE-2023-31213

CVE Patchstack Wordfence WPScan

N/A

< 4.7.4

WPBakery Page Builder < 4.7.4 - Multiple Unspecified Cross-Site Scripting (XSS)

WPScan

N/A

2015-02-10< 4.7.4

WPBakery Page Builder for WordPress (formerly Visual Composer) <= 4.7.3 - Multiple Cross-Site Scripting Issues

Wordfence

N/A

2015-10-09< 4.7.4

WordPress Visual Composer Plugin <= 4.7.3 - Cross Site Scripting

Patchstack

Medium 5.4

2020-11-16< 6.4.1

CVE-2020-28650

CVE Patchstack Wordfence WPScan