CyberRota Analysis
AI-GeneratedThe WPBakery Page Builder plugin for WordPress versions up to 1.0.2 is vulnerable due to a lack of CSRF checks and inadequate data sanitization during the template import process. This allows attackers to exploit the vulnerability by tricking a logged-in administrator into importing a malicious template, leading to Stored Cross-Site Scripting (XSS) that can execute within the administrator's session. WordPress site administrators and security teams should prioritize this vulnerability to mitigate potential exploitation risks.
Original NVD Description
The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via a forged request that results in Stored Cross-Site Scripting executed in the administrator's session.