title: WPBakery Page Builder Clipboard < 4.5.6 - Subscriber+ Stored Cross-Site Scripting (XSS)
description: An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitization, allowing low privilege users (subscriber+) to call it and set XSS payloads, which will be triggered in all backend pages.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: WPBakery Page Builder (Visual Composer) Clipboard
vendor: bitorbit
versions:
lessThan: 4.5.0*, status: affected, version: 4.5.0, versionType: custom
lessThan: 4.5.6, status: affected, version: 4.5.6, versionType: custom
}