Cross-Site Scripting Vulnerability in Visual Composer Website Builder by WPBakery
CVE-2025-46254

5.4MEDIUM

Key Information:

Vendor

Visual Composer

Status
Visual Composer Website Builder
Vendor
CVE Published:
22 April 2025

What is CVE-2025-46254?

A vulnerability exists in the Visual Composer Website Builder that allows for improper neutralization of input during web page generation, resulting in a Stored Cross-Site Scripting (XSS) issue. This security flaw enables attackers to inject malicious scripts, potentially compromising user data and website integrity. Affected versions include Visual Composer Website Builder from n/a through 45.10.0. Website administrators are advised to assess their systems and apply necessary security measures to mitigate the risk associated with this vulnerability.

Affected Version(s)

Visual Composer Website Builder 0 <= 45.10.0

References

https://patchstack.com/database/Wordpress/Plugin/visualco...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

muhammad yudha (Patchstack Alliance)
.