CVE-2026-106596: medium-severity vulnerability in Visual Composer Website Builder
WordPress Visual Composer Website Builder plugin <= 45.16.3 - Broken Access Control vulnerability
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
exploitation probability
0.2%top 85% of all CVEs
observed exploitation
nono source reports it
Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Composer Website Builder: from n/a through 45.16.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Visual Composer · Visual Composer Website BuilderRelated CVEs — Visual Composer Website Builder
In the same product, most dangerous first.
CVE-2024-27997MEDIUMWordPress Visual Composer plugin <= 45.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35653MEDIUMWordPress Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin <= 45.8.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-65568MEDIUMWordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-48276MEDIUMWordPress Visual Composer Website Builder plugin <= 45.11.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-62138MEDIUMWordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-46254MEDIUMWordPress Visual Composer Website Builder plugin <= 45.10.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%