CVE-2025-46254: Visual Composer Website Builder XSS Flaw

CVE-2025-46254 Overview

CVE-2025-46254 is a stored Cross-Site Scripting (XSS) vulnerability in the Visual Composer Website Builder plugin for WordPress. The flaw affects all plugin versions up through 45.10.0 and stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated contributor-level attacker can inject malicious scripts that persist in the page and execute in the browsers of visitors and administrators. Successful exploitation can lead to session theft, account takeover of higher-privileged users, and unauthorized modification of site content.

Critical Impact
Authenticated attackers with low privileges can store JavaScript payloads that execute in the context of any user viewing affected content, enabling privilege escalation through administrator session hijacking.

Affected Products

Visual Composer Website Builder for WordPress (all versions through 45.10.0)
WordPress sites running the visualcomposer plugin with contributor-or-higher accounts
Multi-author WordPress deployments where untrusted users can create or edit content

Discovery Timeline

2025-04-22 - CVE-2025-46254 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46254

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Visual Composer Website Builder plugin. The plugin fails to properly sanitize and escape user-supplied input before rendering it within page content generated by the builder. An authenticated user with contributor-level privileges or higher can inject JavaScript that is persistently stored in the database. The payload executes when any visitor, editor, or administrator loads the affected page.

Because the attack changes the security scope during exploitation, the impact extends beyond the attacker's own privilege level. Stored payloads targeting administrators can be used to create new admin accounts, exfiltrate authentication cookies, or perform privileged actions through the WordPress REST API.

Exploitation requires user interaction, since a victim must load the page or post that contains the malicious element. However, this precondition is trivially satisfied on public-facing sites and multi-author blogs.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Content passed through Visual Composer builder elements is not consistently sanitized with WordPress APIs such as wp_kses_post() or escaped on output with functions like esc_html() and esc_attr(). Attacker-controlled markup, including <script> tags and event-handler attributes, is written into rendered HTML verbatim.

Attack Vector

Exploitation is network-based and requires authenticated access at contributor level or above. The attacker crafts a Visual Composer element containing a JavaScript payload, saves it through the builder interface, and waits for a higher-privileged user to view the resulting page. See the Patchstack Vulnerability Report for additional technical context. No public proof-of-concept or exploit code is currently documented in the referenced advisories.

Detection Methods for CVE-2025-46254

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or DOM event-handler attributes (onerror, onload, onmouseover) stored in the wp_posts or wp_postmeta tables.
Newly created administrator accounts or role changes without a corresponding admin action in the audit log.
Outbound requests from browser sessions to unfamiliar domains immediately after loading Visual Composer pages.

Detection Strategies

Query the WordPress database for post content and meta values containing <script, onerror=, or javascript: substrings introduced by contributor-level accounts.
Review Visual Composer element revisions for injected HTML that does not match the expected element schema.
Monitor web server access logs for anomalous POST requests to /wp-admin/admin-ajax.php originating from low-privileged users.

Monitoring Recommendations

Deploy a Content Security Policy (CSP) with script-src restrictions and log CSP violation reports to surface stored payload execution.
Alert on new WordPress user creations, role escalations, and plugin or theme modifications through file integrity monitoring.
Correlate authentication events with content-editing activity to identify contributor accounts producing malformed HTML.

How to Mitigate CVE-2025-46254

Immediate Actions Required

Update Visual Composer Website Builder to a version later than 45.10.0 as soon as a patched release is available from the vendor.
Audit all contributor, author, and editor accounts and remove or reset any that are unused or unrecognized.
Inspect existing posts and pages created or modified by non-administrator users for injected scripts and remove malicious content.

Patch Information

The vulnerability affects Visual Composer Website Builder versions up to and including 45.10.0. Site administrators should consult the Patchstack Vulnerability Report and the official Visual Composer changelog to confirm the fixed version and apply the update through the WordPress plugin manager.

Workarounds

Restrict contributor and author registration on sites where untrusted user content is not required.
Deploy a Web Application Firewall (WAF) rule that blocks HTML tags and script attributes in Visual Composer AJAX save endpoints.
Enforce a strict Content Security Policy that disallows inline scripts to limit the impact of stored payloads.

bash

# Example WordPress WP-CLI commands to identify and remediate exposure
wp plugin get visualcomposer --field=version
wp user list --role=contributor --fields=ID,user_login,user_registered
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%<script%' OR post_content LIKE '%onerror=%';"
wp plugin update visualcomposer