CVE-2020-36722

Visual Composer <= 26.0 - Multiple Cross-Site Scripting

5.5 Medium

CVE-2020-36722 is a medium vulnerability (CVSS 5.5) in Visual Composer Website Builder, published June 7, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. No source names a fixed version.

The Visual Composer plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 26.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.73%Up 0.7 points since Jun 7, 2023

What each source reports

CVE List Score used 5.5

Visual Composer <= 26.0 - Multiple Cross-Site Scripting

Record: CVE-2020-36722
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2020-24164 5.5

Record: EUVD-2020-24164
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-m9mr-f2hf-53pv 5.5

The Visual Composer plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to,...

Record: GHSA-m9mr-f2hf-53pv
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 5.5

Record: CVE-2020-36722
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD