The vulnerability is a contributor cross‑site scripting flaw that allows malicious code to be injected through the Visual Composer Website Builder plugin’s content editor. An attacker with contributor access can insert crafted JavaScript that will execute in the browsers of visitors who view the compromised pages, potentially leading to session hijacking, defacement, or further injection attacks. The weakness is a classic input validation and sanitization failure as classified by CWE‑79.

The affected product is the Visual Composer Website Builder plugin for WordPress, versions up to and including 45.16.2. Any WordPress site that has installed a vulnerable version of this plugin is at risk. The vendor attribution identifies the plugin as Visual Composer:Visual Composer Website Builder.

The CVSS score of 6.5 indicates a moderate severity vulnerability with potential for widespread impact. The EPSS score is not available, so the exploitation probability cannot be quantified from public data. The weakness is not currently listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no confirmed campaigns against it. Inferred from the description, the most likely attack vector is a malicious or compromised contributor who can edit content within the plugin’s editor; exploitation would require that content be rendered to end users.