CVE-2026-106596
MediumCVSS 5.3Summary
Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Visual Composer Website Builder: from n/a through 45.16.3.
Risk Assessment
An attacker may gain access to editing or configuration functions, potentially leading to unauthorized changes to site content.
Recommendation
Update the Visual Composer Website Builder plugin to a version later than 45.16.3. Review user permissions and roles.
Other vulnerabilities in Visual Composer Website Builder
See all- CVE-2026-97262Medium
Cross Site Scripting (XSS) vulnerability in Visual Composer Website Builder versions up to 45.16.2, exploitable by a contributor.
- CVE-2026-12227Critical
The Visual Composer Website Builder plugin for WordPress up to version 45.16.0 is vulnerable to Local File Inclusion via the `vcv-template` parameter. Unauthenticated attackers can include and execute arbitrary files on the server, allowing execution of any PHP code in those files.
- CVE-2026-62138Medium
The Visual Composer Website Builder plugin in versions up to and including 45.16.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This allows injection of malicious script into site content.
- CVE-2026-65568Medium
The Visual Composer Website Builder plugin version 45.15.0 and earlier has a broken access control vulnerability for users with the Contributor role. A low-privileged user can gain unauthorized access to functions.
Original NVD description (English source)
Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Composer Website Builder: from n/a through 45.16.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS