Visualcomposer vulnerabilities
We track 1 vulnerability in Visualcomposer products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on September 24, 2026.
1vulnerabilities
1critical
0high
0exploited
9.8average CVSS score
Latest Visualcomposer vulnerabilities
- 9.8 Critical severity
Visual Composer Website Builder: Improper Control of Filename for Include/Require Statement in PHP Program
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary