Skip to content
Noroxi

Visual Composer Website Builder

visualcomposer · plugin

Known security vulnerabilities for Visual Composer Website Builder. Find out in seconds which version runs on your site with WP Lens.

10 known vulnerabilities

latest Sep 30, 2026

Listed on wordpress.org · latest 45.16.3 · last updated Sep 24, 2026 · 40K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2025-55709login required≤ 45.15.0

    WordPress Visual Composer Website Builder Plugin < 45.15.0 - Cross Site Scripting (XSS) Vulnerability

    Medium 6.5

  • CVE-2025-48276login required≤ 45.11.0

    WordPress Visual Composer Website Builder plugin <= 45.11.0 - Cross Site Scripting (XSS) Vulnerability

    Medium 6.5

  • CVE-2026-97262contributor+≤ 45.16.2

    WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-62138contributor+≤ 45.16.1

    WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2024-27997high privilege≤ 45.6.0

    WordPress Visual Composer plugin <= 45.6.0 - Cross Site Scripting (XSS) vulnerability

    Medium 5.9

  • CVE-2025-46254login required≤ 45.10.0

    WordPress Visual Composer Website Builder plugin <= 45.10.0 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-35653login required≤ 45.8.0

    WordPress Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin <= 45.8.0 - Cross Site Script

    Medium 5.4

  • CVE-2022-2516login required≤ 45.0

    Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Title'

    Medium 5.4

  • CVE-2022-2430login required≤ 45.0

    Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Text Block'

    Medium 5.4

  • CVE-2026-65568contributor+≤ 45.15.0

    WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulnerability

    Medium 5.0

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory