Medium severity5.5NVD Advisory· Published Jun 7, 2023· Updated Jun 17, 2026
CVE-2020-36722
CVE-2020-36722
Description
The Visual Composer plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 26.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Affected products
2- cpe:2.3:a:visualcomposer:visual_composer_website_builder:*:*:*:*:*:wordpress:*:*Range: <=26.0
- Range: <=26.0
Patches
Vulnerability mechanics
References
4- blog.nintechnet.com/multiple-xss-vulnerabilities-fixed-in-wordpress-visual-composer-plugin/nvdExploit
- wpscan.com/vulnerability/10229nvdThird Party Advisory
- www.wordfence.com/threat-intel/vulnerabilities/id/c476d9af-9060-4294-874a-86e550253d3bnvdThird Party Advisory
- www.acunetix.com/vulnerabilities/web/wordpress-plugin-visual-composer-website-builder-multiple-cross-site-scripting-vulnerabilities-26-0/nvdBroken Link
News mentions
0No linked articles in our index yet.