EUVD-2026-89917
GHSA-hw5j-wg6q-7vx5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor WordPress account
-
DeliveryInject script via Visual Composer editor
-
ExploitPrivileged user views crafted content
-
ExecutionScript executes in admin browser context
-
ImpactSession/privilege abuse in wp-admin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with Contributor-level privileges or higher (PR:L) on a site running Visual Composer Website Builder <= 45.16.2, plus user interaction (UI:R): a separate, typically higher-privileged victim must view or preview the attacker-authored content for the injected script to fire. This is not exploitable against default configurations by an unauthenticated remote attacker - the need for a valid contributor account and a victim's interaction are the key limiting factors that reduce realistic risk despite the network attack vector. |
| Impact | This is a moderate-severity stored/contributor Cross-Site Scripting flaw with a CVSS 3.1 base score of 6.5. The vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable exploitation of low complexity, but it requires an authenticated account with at least Contributor privileges (PR:L) AND victim interaction (UI:R), which meaningfully constrains real-world risk. The scope change (S:C) reflects that injected script executes in the WordPress admin/frontend browser context beyond the plugin boundary. No EPSS score, CISA KEV listing, POC, or SSVC data is provided, so there is no signal of active or automated exploitation - this reads as a real-but-low-urgency issue rather than an emergency. The combination of required privileged authentication (an attacker must already hold a Contributor account) and required user interaction places this firmly below internet-facing unauthenticated flaws in remediation priority. There is no conflict between the CVSS vector and the description: both describe an authenticated contributor injecting script that triggers on another user's view. |
| Exploit ScenarioDerived | An attacker who has registered or obtained a WordPress Contributor-level account uses the Visual Composer editor to embed malicious JavaScript in content they can author. When a higher-privileged user (e.g., an editor or administrator) previews or opens that content, the script executes in their authenticated browser session, potentially performing actions such as creating rogue admin accounts. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Stored cross-site scripting in the Visual Composer Website Builder WordPress plugin through version 45.16.2 lets an authenticated user with Contributor-level access or higher inject script that executes in the browser of another, typically higher-privileged, user who views or previews the crafted content. Attackers need a valid low-privilege account on the target site and must induce a victim to interact with the poisoned page, which limits practical exposure; the flaw carries a CVSS 3.1 base score of 6.5, and no public exploit code was identified at time of analysis. Sites running the affected plugin version with open contributor registration or untrusted author roles carry the greatest risk.
RemediationAI
No vendor-released patch was identified at time of analysis in the available intelligence, and the sole reference is the Patchstack database entry at https://patchstack.com/database/wordpress/plugin/visualcomposer/vulnerability/wordpress-visual-composer-website-builder-plugin-45-16-2-cross-site-scripting-xss-vulnerability, so administrators should monitor that advisory and the plugin's WordPress.org repository for a fixed release and apply it as soon as one is published. Until then, the most effective compensating control is to eliminate the precondition rather than the symptom: restrict the Contributor role and above to vetted, trusted users on any site running the affected plugin, since the flaw requires an authenticated contributor account to plant the payload, and temporarily drop the plugin on sites where untrusted contributors are unavoidable. Auditing and deleting pending or unpublished builder content authored by low-privilege accounts reduces the window in which a stored payload awaits victim interaction, but this is labor-intensive and must be repeated. Deploying a web application firewall or content-security-policy that blocks inline script can reduce execution of injected payloads, though the trade-off is breakage of legitimate builder output and script-dependent features, and these measures are bypassable and should not be treated as equivalent to a patch. Avoid granting contributor accounts plugin or editor preview capabilities to untrusted users, and review any password-reset or session-related actions taken by accounts that previewed suspect content, since XSS in an administrative context can be leveraged for privilege escalation if a higher-privileged session is compromised.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a contributor-level stored/persistent XSS in the Visual Composer Website Builder WordPress plugin, tracked under CPE cpe:2.3:a:visual_composer:visual_composer_website_builder:* (all versions through 45.16.2). WordPress separates content authoring from publishing, so users holding the Contributor role can create and submit content but cannot publish it directly; the plugin fails to properly sanitize or escape the markup produced by its drag-and-drop builder when that content is stored and later rendered. Because the injected payload is persisted in the database and rendered in an administrative or editorial context, the CVSS vector reports a changed scope (S:C), meaning the exploited component can affect resources beyond its own security authority, and a successful payload executes with the privileges of the victim's session rather than the attacker's. The PR:L/UI:R components reflect the two gating conditions from the independent assessment: a valid Contributor-or-higher account on the vulnerable site, and a separate victim who must view or preview the attacker-authored content. Confidentiality, integrity, and availability impacts are each rated Low.
Know when Visual Composer Website Builder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Contributor account needed (PR:L), victim must view content (UI:R), injected script escapes plugin into browser context (S:C) with limited C/I/A impact typical of XSS.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Unauthenticated local file inclusion in the Visual Composer Website Builder plugin for WordPress (all versions up to and
The Visual Composer plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 26.0 du
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Vi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Vi
Stored Cross-Site Scripting in Visual Composer Website Builder WordPress plugin (versions up to and including 45.16.1) a
The Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages pl
The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post/page
The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Bloc
Broken access control in Visual Composer Website Builder plugin for WordPress allows authenticated attackers with low pr
Exploit-DB