Cross Site Scripting Vulnerability in Visual Composer Website Builder by Visual Composer
CVE-2026-62138

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Visual Composer Website Builder
Vendor
CVE Published:
11 September 2026

What is CVE-2026-62138?

The Visual Composer Website Builder for WordPress is vulnerable to Cross Site Scripting (XSS) attacks in versions equal to or prior to 45.16.1. This vulnerability allows attackers to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized access or data theft. Users and site administrators are advised to update to the latest version promptly to mitigate these security risks.

Affected Version(s)

Visual Composer Website Builder <= 45.16.1

References

https://patchstack.com/database/wordpress/plugin/visualco...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sungbyeongchan | Patchstack Bug Bounty Program
.