Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-36722

The Visual Composer plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 26.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Published

2023-06-07T02:15:12.357

Last Modified

2024-11-21T05:30:09.710

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.5 (MEDIUM)

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	visualcomposer	visual_composer_website_builder	≤ 26.0	Yes

References

https://blog.nintechnet.com/multiple-xss-vulnerabilities-fixed-in-wordpress-visual-composer-plugin/ Exploit ([email protected])
https://wpscan.com/vulnerability/10229 Third Party Advisory ([email protected])
https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-visual-composer-website-builder-multiple-cross-site-scripting-vulnerabilities-26-0/ Broken Link ([email protected])
https://www.wordfence.com/threat-intel/vulnerabilities/id/c476d9af-9060-4294-874a-86e550253d3b?source=cve Third Party Advisory ([email protected])
https://blog.nintechnet.com/multiple-xss-vulnerabilities-fixed-in-wordpress-visual-composer-plugin/ Exploit (af854a3a-2127-422b-91ae-364da2661108)
https://wpscan.com/vulnerability/10229 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-visual-composer-website-builder-multiple-cross-site-scripting-vulnerabilities-26-0/ Broken Link (af854a3a-2127-422b-91ae-364da2661108)
https://www.wordfence.com/threat-intel/vulnerabilities/id/c476d9af-9060-4294-874a-86e550253d3b?source=cve Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)