CVE-2026-62138: Visual Composer Website Builder XSS Vulnerability

CVE-2026-62138 Overview

CVE-2026-62138 is a stored Cross-Site Scripting (XSS) vulnerability in the Visual Composer Website Builder plugin for WordPress. The flaw affects all versions up to and including 45.16.1. Authenticated users with Contributor-level privileges can inject malicious scripts that execute in the browsers of other users, including administrators viewing affected content.

The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. Exploitation requires user interaction, and the scope change indicates that impact extends beyond the vulnerable component to the wider WordPress session context.

Critical Impact
A Contributor-level attacker can inject persistent JavaScript that executes when an administrator or other privileged user renders the affected page, enabling session hijacking, privilege escalation, or arbitrary administrative actions.

Affected Products

Visual Composer Website Builder plugin for WordPress
All versions <= 45.16.1
WordPress sites permitting Contributor-level registration or accounts

Discovery Timeline

2026-09-11 - CVE-2026-62138 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-62138

Vulnerability Analysis

The vulnerability resides in how the Visual Composer Website Builder plugin processes and renders content submitted by authenticated users with the Contributor role. User-supplied input is not adequately sanitized or escaped before being embedded into rendered HTML output. This allows attackers to store JavaScript payloads that later execute in a victim's browser.

Because the CVSS vector reports a scope change, injected scripts execute in the context of the WordPress administration interface rather than being confined to the plugin's own component boundary. An attacker with the minimum privilege of Contributor can therefore target higher-privileged users who preview or moderate submitted content.

The EPSS score of 0.13% suggests limited public exploitation activity at this time. However, WordPress plugins with millions of installations remain attractive targets for opportunistic attackers, and Contributor-level XSS is a well-established path toward site takeover.

Root Cause

The root cause is improper neutralization of user-controlled input during page generation. The plugin fails to apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses_post() on Contributor-submitted data before rendering. Refer to the Patchstack advisory for component-level details.

Attack Vector

An attacker registers or compromises a WordPress account with the Contributor role. The attacker then creates or edits content using the Visual Composer builder, embedding a JavaScript payload within a vulnerable field. When an administrator or editor reviews, previews, or publishes the content, the payload executes in their authenticated browser session. The attacker can then perform actions such as creating administrator accounts, modifying theme files, or installing malicious plugins.

No verified proof-of-concept code is publicly available at this time. Consult the Patchstack WordPress Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2026-62138

Indicators of Compromise

WordPress posts, pages, or Visual Composer elements containing <script> tags, on* event handlers, or javascript: URIs authored by Contributor accounts.
Unexpected administrator or editor account creation shortly after a Contributor submitted or edited content.
Modified plugin, theme, or wp_options records following administrator sessions that previewed Contributor content.
Outbound requests from browser sessions to unfamiliar domains when administrators render Visual Composer pages.

Detection Strategies

Audit WordPress post and postmeta tables for HTML event handlers or script tags in fields populated by the Visual Composer plugin.
Review web server access logs for POST requests to /wp-admin/admin-ajax.php and Visual Composer save endpoints originating from Contributor accounts.
Deploy Content Security Policy (CSP) reporting to surface inline script execution originating from the WordPress admin interface.
Correlate role changes and plugin installations with recent Contributor content activity in the audit trail.

Monitoring Recommendations

Enable a WordPress activity log plugin to record all Contributor content submissions, edits, and administrator previews.
Monitor for privilege changes, new administrator user creation, and modifications to wp-config.php or active theme files.
Alert on unexpected file writes within wp-content/plugins/ and wp-content/themes/ directories.
Track EPSS score changes and vendor advisory updates for the Visual Composer plugin.

How to Mitigate CVE-2026-62138

Immediate Actions Required

Update the Visual Composer Website Builder plugin to a version later than 45.16.1 as soon as the vendor releases a patched build.
Audit all existing WordPress user accounts and remove or downgrade unused Contributor-level accounts.
Review recent Contributor-authored content for embedded scripts or suspicious HTML before allowing administrators to preview it.
Rotate credentials and session tokens for any administrator who previewed suspect Contributor content.

Patch Information

Monitor the Patchstack advisory and the official Visual Composer changelog for a fixed release above version 45.16.1. Apply the patched version across all WordPress installations that use the plugin, including staging and development environments.

Workarounds

Disable open user registration or restrict registration to trusted email domains until the plugin is patched.
Temporarily deactivate the Visual Composer Website Builder plugin on sites where Contributor accounts exist and cannot be removed.
Deploy a web application firewall (WAF) rule to block requests containing common XSS payload patterns targeting Visual Composer save endpoints.
Enforce a strict Content Security Policy that disallows inline scripts within the WordPress admin interface.

bash

# Configuration example: enforce restrictive CSP header in Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"

# Restrict WordPress user registration in wp-config.php
define('DISALLOW_FILE_EDIT', true);
# Then in WordPress Settings > General, uncheck "Anyone can register"