The vulnerability allows attackers to inject malicious scripts that are stored within the website content, which are then executed in the browsers of any visitors to that content. This can lead to unauthorized session hijacking, defacement of pages, and theft of sensitive data by exploiting the compromised user’s browser. The flaw results from improper neutralization of input during page generation, making it a classic stored XSS flaw.

The issue affects the Visual Composer Website Builder plugin for WordPress released before version 45.15.0. All installations of the plugin with a version older than 45.15.0 that allow content creation or editing via Visual Composer are vulnerable.

With a CVSS score of 6.5 and an EPSS score of less than 1%, the vulnerability is of moderate severity and currently has a low likelihood of exploitation. It is not listed in CISA KEV, indicating no known broad exploitation. Based on the description, it is inferred that attackers can exploit it by injecting malicious script payloads through the plugin’s content or design editors, which are then stored and served to all site users. The risk remains significant because any user who views the compromised content would execute the injected script in their browser.