What’s Vulnerable › Products
Visual Composer Website Builder vulnerabilities
14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.
Check whether your Visual Composer Website Builder version is affected
Latest Visual Composer Website Builder vulnerabilities
- CVE-2026-106596 — WordPress Visual Composer Website Builder plugin <= 45.16.3 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2026-97262 — WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-12227 — Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter (CVSS 9.8)
- CVE-2026-62138 — WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-65568 — WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulnerability (CVSS 5.0)
- CVE-2025-55709 — WordPress Visual Composer Website Builder Plugin < 45.15.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- CVE-2025-48276 — WordPress Visual Composer Website Builder plugin <= 45.11.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- CVE-2025-46254 — WordPress Visual Composer Website Builder plugin <= 45.10.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
- CVE-2024-35653 — WordPress Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin <= 45.8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
- CVE-2024-27997 — WordPress Visual Composer plugin <= 45.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- CVE-2023-6880 — Visual Composer Premium <= 45.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2020-36722 — Visual Composer <= 26.0 - Multiple Cross-Site Scripting (CVSS 4.8)
- CVE-2022-2516 — Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Title' (CVSS 5.4)
- CVE-2022-2430 — Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Text Block' (CVSS 5.4)