Visual Composer Website Builder (Visualcomposer) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 113 known versions, newest CVE from 2026-09-24. Vendor: Visualcomposer.

CVEs of Visual Composer Website Builder

• CVE-2026-12227 - CVSS 9.8 (critical), 2026-09-24: The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the…
• CVE-2025-46254 - CVSS 6.5 (medium), 2025-04-22: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder…
• CVE-2024-35653 - CVSS 6.5 (medium), 2024-06-04: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder…
• CVE-2023-6880 - CVSS 6.4 (medium), 2024-03-13: The Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin for WordPress is vulnerable to…
• CVE-2020-36722 - CVSS 5.5 (medium), 2023-06-07: The Visual Composer plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 26.0 due to insufficient input sanitization…
• CVE-2022-2516 - CVSS 6.4 (medium), 2022-09-06: The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post/page 'Title' value in versions up to, and…
• CVE-2022-2430 - CVSS 6.4 (medium), 2022-09-06: The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Block' feature in versions up to, and…