Visual Composer Website Builder < 45.0.1 – Authenticated Stored XSS via Text Block | CVE 2022-2430 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape its Text Block fields, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks

Proof of Concept

Create a post using the plugin editor, add a Text Block and put the following payload in its content: <img src onerror=alert(/XSS/)>

The XSS will be triggered when editing the post again, as well as when viewing the post

Affects Plugins

Fixed in 45.0.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Zhouyuan Yang

Verified

Yes

WPVDB ID

6e01bc29-6e4f-421f-9144-845c8a18f79d

Timeline

Publicly Published

2022-08-29 (about 3 years ago)

Added

2022-08-30 (about 3 years ago)

Last Updated

2022-09-02 (about 3 years ago)

Other

Published

Title

Published

2025-05-14

Title

Bon Toolkit <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2023-12-11

Title

WP TripAdvisor Review Slider < 11.9 - Admin+ Stored XSS

Published

2014-08-01

Title

Accept Signups 0.1 - XSS

Published

2014-08-01

Title

Register Plus Redux <= 3.8.3 - Cross-Site Scripting (XSS)

Published

2026-04-03

Title

WPFunnels < 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode