What’s Vulnerable › Vulnerabilities

CVE-2021-24243: WPBakery Page Builder Clipboard < 4.5.6 - Subscriber+ Stored Cross-Site Scripting (XSS)

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-05-06 · updated 2026-06-17
• Weakness: CWE-79

Description

An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitization, allowing low privilege users (subscriber+) to call it and set XSS payloads, which will be triggered in all backend pages.

Affected products

• bitorbit WPBakery Page Builder (Visual Composer) Clipboard: from 4.5.0 before 4.5.6 — fixed in 4.5.6

How to fix

Upgrade to a fixed version: bitorbit WPBakery Page Builder (Visual Composer) Clipboard 4.5.6. Check the vendor advisory for mitigations.

References

• https://codecanyon.net/item/visual-composer-clipboard/8897711
• https://wpscan.com/vulnerability/3bc0733a-b949-40c9-a5fb-f56814fc4af3
• https://codecanyon.net/item/visual-composer-clipboard/8897711
• https://wpscan.com/vulnerability/3bc0733a-b949-40c9-a5fb-f56814fc4af3

Get alerted when CVE-2021-24243 or the next vulnerability affects your stack