Improper neutralization of user input during web page generation in the Visual Composer Website Builder plugin permits an attacker to store malicious scripts that will execute in the browsers of any visitor who loads a compromised page. The stored cross‑site scripting (CWE‑79) can lead to arbitrary client‑side code execution within the site context, potentially exposing sensitive data, hijacking sessions, or enabling further web‑based attacks.

All installations of the WordPress Visual Composer Website Builder plugin with versions from the earliest release through 45.10.0 are affected. Users operating the plugin on any WordPress site are at risk.

The CVSS score of 6.5 indicates medium severity, and the EPSS score of less than 1 % suggests a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires an attacker to create or edit a piece of content within the plugin’s interface that contains unsanitized JavaScript; once the content is viewed by a site visitor, the script runs in the victim’s browser, enabling the attacker to execute arbitrary code in the site’s context.