CVE-2026-62138: WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability
Published Sep 11, 2026
·Updated
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions.
Affected Software
1 affected component
WordPress Visual Composer Website Builder<=45.16.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Visual Composer Website Builder pluginto a version that resolves this vulnerability.Fixed in 45.16.2
Event History
Sep 11, 2026
CVE Published
via MITRE·06:12 PM
Data Sourced
via MITRE·06:12 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Which users can exploit this issue?
The vulnerability is described as contributor-level XSS, so exploitation requires an account with Contributor privileges.
2
Does exploitation require user interaction?
Yes. The vector indicates user interaction is required, meaning a victim must interact with attacker-controlled content for the XSS to execute.
3
What versions are affected?
Visual Composer Website Builder versions 45.16.1 and earlier are affected.