CVE-2023-6880: Visual Composer Premium <= 45.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions up to, and including, 45.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6880?
CVE-2023-6880 is classified as a moderate severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2023-6880?
To fix CVE-2023-6880, update the Visual Composer Website Builder plugin to a version beyond 45.6.0, where the input sanitization issues have been addressed.
What types of attacks can CVE-2023-6880 lead to?
CVE-2023-6880 can lead to stored cross-site scripting attacks, allowing attackers to inject malicious scripts that may compromise user data.
Which versions of the Visual Composer Website Builder are affected by CVE-2023-6880?
All versions of the Visual Composer Website Builder up to and including 45.6.0 are affected by CVE-2023-6880.
Is there a workaround for CVE-2023-6880?
There are no official workarounds for CVE-2023-6880; the best mitigation is to upgrade to the latest version of the plugin.