CVE-2024-43953 in WPBakery Page Builder Plugin
Summary
by MITRE • 08/29/2024
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder classic-addons-wpbakery-page-builder-addons allows Stored XSS.This issue affects Classic Addons – WPBakery Page Builder: from n/a through <= 3.5.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/02/2026
This cross-site scripting vulnerability exists within the webcodingplace Classic Addons plugin for WPBakery Page Builder, specifically impacting versions up to and including 3.5. The flaw represents a classic stored XSS vulnerability where malicious input is not properly sanitized during web page generation, allowing attackers to inject persistent malicious scripts into the application's output. The vulnerability occurs when user-supplied data is directly rendered into web pages without adequate input validation or output encoding, creating a persistent security risk that can affect multiple users who view the compromised content. This type of vulnerability falls under CWE-79 which specifically addresses cross-site scripting flaws in web applications, where improper neutralization of input during web page generation enables attackers to execute malicious scripts in the context of the victim's browser.
The operational impact of this vulnerability is significant as it allows attackers to establish persistent malicious presence within the targeted WordPress environment. Once exploited, attackers can execute arbitrary JavaScript code in the context of authenticated users' browsers, potentially leading to session hijacking, credential theft, or unauthorized administrative actions. The stored nature of this XSS means that malicious scripts are saved on the server and executed whenever affected pages are loaded, making the attack persistent and potentially affecting all users who access the compromised content. This vulnerability can be exploited through various vectors including form inputs, comment sections, or any user-controllable data field within the Classic Addons plugin interface that generates web content.
Security professionals should note that this vulnerability directly maps to ATT&CK technique T1531 which involves the use of malicious code injection to gain unauthorized access to systems. The affected plugin's failure to properly neutralize input during web page generation creates an attack surface that can be leveraged for privilege escalation, data exfiltration, or further lateral movement within the compromised environment. Organizations using this plugin should immediately assess their current version and apply the latest available updates from the vendor to mitigate this risk. The vulnerability demonstrates the critical importance of input validation and output encoding in web applications, as even minor oversights in sanitization can create significant security risks. Additionally, implementing content security policies and regular security audits of third-party plugins can help prevent similar vulnerabilities from being exploited in the future, particularly given that many organizations rely heavily on plugin ecosystems for extending their WordPress functionality.