A high-severity vulnerability in the Export & Import WPBakery Page Builder plugin allows unauthenticated attackers to execute arbitrary scripts within an administrator session via a CSRF-led XSS attack.

The plugin fails to perform CSRF checks on the template-import feature and neglects to sanitize imported data, resulting in Stored Cross-Site Scripting (XSS). An unauthenticated attacker can trick a logged-in administrator into importing a malicious template, triggering script execution in the administrator's browser context.

Successful exploitation allows an attacker to gain unauthorized access to administrative sessions, potentially leading to full site compromise, data theft, or the injection of malicious content into the website. With a CVSS score of 7.1, this represents a significant risk to the integrity and confidentiality of the WordPress environment, necessitating prompt attention to prevent administrative account takeover.

Immediate Action: Since a specific patch version is currently unknown, administrators should deactivate and remove the Export & Import WPBakery Page Builder plugin until a secure update is provided by the vendor.

Proactive Monitoring: Review web server logs for suspicious POST requests targeting template import endpoints, particularly those originating from unexpected referrers.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized or suspicious file uploads and cross-site scripting patterns targeting the administrative dashboard.

Public Exploit Available: Unknown.

The combination of Cross-Site Request Forgery and Cross-Site Scripting poses a serious threat to administrative integrity. Organizations using this plugin should prioritize its immediate removal or restrict access to the affected functionality until the vendor releases a verified security update. Monitoring administrative logs for unusual activity is highly recommended until the plugin is fully patched or replaced.