(Medium Priority) A potential vulnerability related to Cross Site Scripting (XSS) was found for the WPBakery Page Builder plugin.

What Steps Did ClearPG Take?

• We were notified about the issue and checked for any sites that might be affected.
• For our managed hosting customers, we automatically updated the plugin to the latest version after verifying the vulnerability was fixed.

References:

• https://patchstack.com/database/vulnerability/js_composer/wordpress-wpbakery-visual-composer-plugin-7-5-authenticated-contributor-stored-cross-site-scripting-via-attributes-vulnerability?_a_id=350
• https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/js_composer-2/wpbakery-visual-composer-75-authenticated-contributor-stored-cross-site-scripting-via-button-onclick-attribute-1
• https://kb.wpbakery.com/docs/preface/release-notes/