CVE-2026-62138
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Visual Composer Website Builder plugin in versions up to and including 45.16.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This allows injection of malicious script into site content.
Risk Assessment
Script injection may lead to session theft, account takeover, or modification of content visible to other site users.
Recommendation
Update the Visual Composer Website Builder plugin to a version newer than 45.16.1 as soon as a fix becomes available, and review permissions for users with the Contributor role.
Other vulnerabilities in Visual Composer Website Builder
See all- CVE-2026-65568Medium
The Visual Composer Website Builder plugin version 45.15.0 and earlier has a broken access control vulnerability for users with the Contributor role. A low-privileged user can gain unauthorized access to functions.
- CVE-2026-12227Critical
The Visual Composer Website Builder plugin for WordPress up to version 45.16.0 is vulnerable to Local File Inclusion via the `vcv-template` parameter. Unauthenticated attackers can include and execute arbitrary files on the server, allowing execution of any PHP code in those files.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions.