This vulnerability in Visual Composer Website Builder (<= 45.6.0) allows improper neutralization of input during web page generation, resulting in a cross-site scripting (XSS) issue. The CVSS 3.1 base score is 5.9 (medium), with network attack vector, low attack complexity, requiring high privileges and user interaction, and impacts confidentiality, integrity, and availability in a limited manner. No patch or vendor advisory is available at this time, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker with high privileges to execute malicious scripts in the context of the affected web application, potentially leading to limited confidentiality, integrity, and availability impacts. Since user interaction is required, the risk is mitigated somewhat. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit high privilege access and be cautious with user interactions that could trigger this vulnerability. Monitor official Visual Composer communications for updates.