Cross-Site Scripting Vulnerability in Visual Composer Plugin for WordPress
CVE-2020-36722

5.5MEDIUM

Key Information:

Vendor
Wordpress
Status
Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages
Vendor
CVE Published:
7 June 2023

Summary

The Visual Composer plugin for WordPress, in its versions up to and including 26.0, has a vulnerability that allows attackers to exploit insufficient input sanitization and output escaping. This Cross-Site Scripting (XSS) issue can let attackers inject malicious web scripts that run in the browser of unwitting users, potentially leading to data theft or unauthorized actions on the affected site. Website owners using this plugin should apply the necessary patches and updates to safeguard against such threats.

Affected Version(s)

Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages * <= 26.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://blog.nintechnet.com/multiple-xss-vulnerabilities-...
https://wpscan.com/vulnerability/10229

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jerome Bruandet
.