CVE-2026-97262: WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Visual Composer Website Builder pluginto a version that resolves this vulnerability.Fixed in 45.16.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs Contributor-level access to a WordPress site using the affected Visual Composer Website Builder plugin. The attack vector is network-accessible, but user interaction is required for exploitation.
What versions are affected?
Visual Composer Website Builder versions up to and including 45.16.2 are affected.
What is the potential impact?
Successful exploitation can lead to cross-site scripting with low impact to confidentiality, integrity, and availability. The vulnerability has changed scope, meaning its effects can extend beyond the vulnerable component's security authority.