WordPress security by component
Visual Composer Website Builder
Plugin description
Visual Composer Website Builder is a WordPress component with 5 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest CVE/CNA score is 6.5.
Plugin slug:
visualcomposerLatest vulnerability
CVE-2026-65568: Visual Composer contributors can reach a privileged operation
Visual Composer Website Builder through 45.15.0 lets a Contributor reach a plugin operation without the required capability or ownership check. The Patchstack CNA record does not disclose the endpoint, action, parameter, function, protected object or concrete operation, so the exact integrity or confidentiality impact remains unknown.
| Safe version |
|
||
|---|---|---|---|
| Jul 27, 2026 |
CVE-2026-65568
Visual Composer contributors can reach a privileged operation
Visual Composer Website Builder through 45.15.0 lets a Contributor reach a plugin operation without the required capability or ownership check. The Patchstack CNA record does not disclose the endpoint, action, parameter, function, protected object or concrete operation, so the exact integrity or confidentiality impact remains unknown.
|
45.16.0 |
CVE5.0
NVDPending
|
| Aug 14, 2025 |
CVE-2025-55709
Visual Composer Website Builder: Cross-site scripting
Visual Composer Website Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| May 19, 2025 |
CVE-2025-48276
Visual Composer Website Builder: Cross-site scripting
Visual Composer Website Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Jun 04, 2024 |
CVE-2024-35653
Visual Composer Website Builder: Cross-site scripting
Visual Composer Website Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVD5.4
|
| Mar 19, 2024 |
CVE-2024-27997
Visual Composer Website Builder: Cross-site scripting
Visual Composer Website Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVDPending
|