The Visual Composer plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 26.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
References
Configurations
Configuration 1 (hide)
|
History
13 Jun 2023, 13:58
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/c476d9af-9060-4294-874a-86e550253d3b?source=cve - Third Party Advisory | |
| References | (MISC) https://wpscan.com/vulnerability/10229 - Third Party Advisory | |
| References | (MISC) https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-visual-composer-website-builder-multiple-cross-site-scripting-vulnerabilities-26-0/ - Broken Link | |
| References | (MISC) https://blog.nintechnet.com/multiple-xss-vulnerabilities-fixed-in-wordpress-visual-composer-plugin/ - Exploit | |
| CPE | cpe:2.3:a:visualcomposer:visual_composer_website_builder:*:*:*:*:*:wordpress:*:* | |
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.8 |
| First Time |
Visualcomposer visual Composer Website Builder
Visualcomposer |
07 Jun 2023, 02:44
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-07 02:15
Updated : 2024-02-28 20:13
NVD link : CVE-2020-36722
Mitre link : CVE-2020-36722
CVE.ORG link : CVE-2020-36722
JSON object : View
Products Affected
visualcomposer
- visual_composer_website_builder
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')