CVE-2025-55709: WordPress Visual Composer Website Builder Plugin < 45.15.0 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder allows Stored XSS. This issue affects Visual Composer Website Builder: from n/a through n/a.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Stored XSS.This issue affects Visual Composer Website Builder: from n/a through < 45.15.0.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55709?
CVE-2025-55709 is categorized as a Critical severity vulnerability due to its potential for stored Cross-site Scripting (XSS) attacks.
How do I fix CVE-2025-55709?
To fix CVE-2025-55709, it is recommended to update Visual Composer Website Builder to the latest version beyond 45.15.0.
What are the consequences of CVE-2025-55709?
Exploitation of CVE-2025-55709 can lead to unauthorized access to sensitive user data through stored XSS attacks.
Which versions are affected by CVE-2025-55709?
CVE-2025-55709 affects Visual Composer Website Builder versions up to and including 45.15.0.
Who is impacted by CVE-2025-55709?
Users of the Visual Composer Website Builder and the WordPress Visual Composer Website Builder Plugin are at risk from CVE-2025-55709.