visualcomposer vulnerabilities and threats

9 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.3	EPSS 0.2%	CVE-2026-106596Visual Composer Website Builder (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.2%2026-10-08CVE Database V5CVE-2026-106596 Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Composer Website Builder: from n/a through 45.16.3. EPSS 0.2%Vulnerability	CVE Database V5	2026-10-08
Medium	6.5	EPSS 0.1%	CVE-2026-97262Visual Composer Website Builder (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.1%2026-09-30CVE Database V5CVE-2026-97262 Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions. EPSS 0.1%Vulnerability CWE-79	CVE Database V5	2026-09-30
Critical	9.8	EPSS 2.8%	CVE-2026-12227Visual Composer Website Builder (WordPress plugin) · PHP Remote File Inclusion Critical9.8EPSS 2.8%2026-09-24CVE Database V5CVE-2026-12227 The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. EPSS 2.8%Vulnerability visualcomposer CWE-98	CVE Database V5	2026-09-24
Medium	6.5	EPSS 0.2%	CVE-2026-62138Visual Composer Website Builder (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2026-09-11CVE Database V5CVE-2026-62138 Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions. EPSS 0.2%Vulnerability CWE-79 #ghsa-68gg-v2fh-7wgg	CVE Database V5	2026-09-11
Medium	5.0	EPSS 0.3%	CVE-2026-65568Visual Composer Website Builder (WordPress plugin) · Missing Authorization Medium5.0EPSS 0.3%2026-07-27CVE Database V5CVE-2026-65568 Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions. EPSS 0.3%Vulnerability CWE-862	CVE Database V5	2026-07-27
Medium	6.5	EPSS 0.2%	CVE-2025-55709Visual Composer Website Builder (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2025-08-14CVE Database V5CVE-2025-55709 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Stored XSS.This issue affects Visual Composer Website Builder: from n/a through < 45.15.0. EPSS 0.2%Vulnerability	CVE Database V5	2025-08-14
Medium	6.5	EPSS 0.3%	CVE-2024-43263Visual Composer Starter (WordPress plugin) · XSS or 'Cross-site Scripting' Medium6.5EPSS 0.3%2024-08-18CVE Database V5CVE-2024-43263 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Visual Composer Visual Composer Starter allows Stored XSS.This issue affects Visual Composer Starter: from n/a through 3.3. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2024-08-18
Medium	6.5	EPSS 0.3%	CVE-2024-35653Visual Composer Website Builder (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.3%2024-06-04CVE Database V5CVE-2024-35653 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer.This issue affects Visual Composer Website Builder: from n/a through <= 45.8.0. EPSS 0.3%Vulnerability	CVE Database V5	2024-06-04
Medium	5.9	EPSS 0.3%	CVE-2024-27997Visual Composer Website Builder (WordPress plugin) · Cross-site Scripting Medium5.9EPSS 0.3%2024-03-19CVE Database V5CVE-2024-27997 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer.This issue affects Visual Composer Website Builder: from n/a through <= 45.6.0. EPSS 0.3%Vulnerability	CVE Database V5	2024-03-19

Page 1 of 1