CVE-2026-97262
MediumCVSS 6.5Summary
Cross Site Scripting (XSS) vulnerability in Visual Composer Website Builder versions up to 45.16.2, exploitable by a contributor.
Risk Assessment
A contributor can inject malicious script, potentially leading to data theft or session hijacking.
Recommendation
Update Visual Composer Website Builder to the latest patched version.
Other vulnerabilities in Visual Composer Website Builder
See all- CVE-2026-106596Medium
Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Visual Composer Website Builder: from n/a through 45.16.3.
- CVE-2026-12227Critical
The Visual Composer Website Builder plugin for WordPress up to version 45.16.0 is vulnerable to Local File Inclusion via the `vcv-template` parameter. Unauthenticated attackers can include and execute arbitrary files on the server, allowing execution of any PHP code in those files.
- CVE-2026-62138Medium
The Visual Composer Website Builder plugin in versions up to and including 45.16.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This allows injection of malicious script into site content.
- CVE-2026-65568Medium
The Visual Composer Website Builder plugin version 45.15.0 and earlier has a broken access control vulnerability for users with the Contributor role. A low-privileged user can gain unauthorized access to functions.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS