Description

Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-11T19:17:45.270Z",
  "pubdate": "2026-09-11T19:17:45.270Z",
  "executiveSummary": "This vulnerability is identified as a Stored Cross-Site Scripting (XSS) flaw affecting the Visual Composer Website Builder plugin.\nThe vulnerability allows authenticated users with contributor-level privileges or higher to inject malicious JavaScript into the application's environment.\nThe vulnerability resides in the way the plugin processes and renders user-supplied input within the website builder interface.\nSuccessful exploitation enables an attacker to execute arbitrary scripts in the browser of an unsuspecting victim, which could lead to unauthorized actions performed on behalf of the user, session hijacking, or the compromise of administrative accounts.\nAffected systems include Visual Composer Website Builder versions 45.16.1 and below.\nThe risk is categorized as significant because, while it requires authenticated access, it grants an attacker the ability to escalate their impact within the WordPress ecosystem by targeting higher-privileged users such as administrators.\nThe vulnerability does not require complex network conditions, merely the ability for an attacker to save content using the plugin's builder interface.",
  "technicalDetails": "The vulnerability is categorized as Stored Cross-Site Scripting (XSS), stemming from insufficient input sanitization and output escaping mechanisms within the Visual Composer Website Builder plugin.\nThe flaw exists because the plugin fails to properly validate data supplied via specific builder components before storing it in the database.\nWhen a user with contributor privileges saves a post or page containing the malicious payload, the injected JavaScript is persisted in the WordPress database.\nThe payload is subsequently executed when an administrator or another user views the affected post or attempts to edit the malicious content within the Visual Composer interface.\nAttack flow: An authenticated attacker with access to the Visual Composer editor inserts a crafted malicious script payload into a text-based input field or custom component attribute.\nBecause the application performs inadequate output encoding during the rendering of the builder interface, the browser interprets the injected script as legitimate markup rather than plain text.\nThis triggers the execution of the payload within the security context of the victim's session.\nThe vulnerability is specifically present in versions <= 45.16.1.\nThe core issue involves the plugin's interaction with the WordPress editor API, where raw input data is processed without strict enforcement of HTML element and attribute allow-lists.\nPost-exploitation impact includes the potential for session token theft via cookie access (if not protected by HttpOnly flags), redirection to malicious external sites, modification of website content, or the injection of additional administrative users through forged requests initiated by the script.\nBecause this vulnerability is triggered in the back-end administrative area of WordPress, the exposure is significant, as it specifically targets the users responsible for managing the integrity of the website."
}