WPBakery Page Builder <= 6.4 is vulnerable to Authenticated Stored Cross-Site Scripting (XSS) vulnerability

The WPBakery plugin for WordPress, in versions 6.4 and below, was designed with a flaw that could give users with contributor and author level roles the ability to inject malicious JavaScript into pages and posts. This flaw also gave these users the ability to edit other users’ posts. The plugin explicitly disabled any default post HTML filtering checks in the saveAjaxFe function using kses_remove_filters();. This meant that any user with access to the WPBakery builder could inject HTML and JavaScript anywhere in a post using the page builder.