Known vulnerabilities in Visual Composer Website Builder

Drag and drop page builder that gives the freedom to design WordPress websites, landing pages, custom themes, maintenance mode & coming soon pages.

14Reported vulnerabilities

9.8Highest CVSS score

45.16.1Latest version

40,000+Active installs

What to do now

Update Visual Composer Website Builder to 45.16.4 or later. 14 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 23, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2026-12227	Critical 9.8	2.9%	45.16.0 and earlier	`45.16.1`	September 23, 2026
CVE-2020-36722	Medium 4.8	0.7%	26.0 and earlier	`27.0`	June 7, 2023
CVE-2025-48276	Medium 6.4	0.3%	45.11.0 and earlier	`45.12.0`	May 19, 2025
CVE-2026-97262	Medium 6.4	0.1%	45.16.2 and earlier	`45.16.3`	September 30, 2026
CVE-2026-62138	Medium 6.4	0.2%	45.16.1 and earlier	`45.16.2`	September 10, 2026
CVE-2025-55709	Medium 6.4	0.2%	45.13.0 and earlier	`45.15.0`	August 14, 2025
CVE-2025-46254	Medium 6.4	0.2%	45.10.0 and earlier	`45.11.0`	April 22, 2025
CVE-2023-6880	Medium 5.4	0.4%	45.6.0 and earlier	`45.7.0`	March 13, 2024
CVE-2022-2516	Medium 5.4	0.6%	45.0 and earlier	`45.0.1`	September 6, 2022
CVE-2022-2430	Medium 5.4	0.6%	45.0 and earlier	`45.0.1`	September 6, 2022
CVE-2024-35653	Medium 4.4	0.3%	45.8.0 and earlier	`45.9.0`	June 3, 2024
CVE-2024-27997	Medium 4.4	0.3%	45.6.0 and earlier	`45.7.0`	March 15, 2024
CVE-2026-106596	Medium 4.3	0.2%	45.16.3 and earlier	`45.16.4`	October 8, 2026
CVE-2026-65568	Medium 4.3	0.3%	45.15.0 and earlier	`45.16.0`	July 24, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.