Visual Composer Website Builder vulnerabilities
3 known CVE vulnerabilities in Visual Composer Website Builder, translated and rated.
- CVE-2026-65568Medium
The Visual Composer Website Builder plugin version 45.15.0 and earlier has a broken access control vulnerability for users with the Contributor role. A low-privileged user can gain unauthorized access to functions.
- CVE-2026-12227Critical
The Visual Composer Website Builder plugin for WordPress up to version 45.16.0 is vulnerable to Local File Inclusion via the `vcv-template` parameter. Unauthenticated attackers can include and execute arbitrary files on the server, allowing execution of any PHP code in those files.
- CVE-2026-62138Medium
The Visual Composer Website Builder plugin in versions up to and including 45.16.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This allows injection of malicious script into site content.