CVE-2022-2516

The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post/page 'Title' value in versions up to, and including, 45.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the visual composer editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2778808%40visualcomposer&new=2778808%40visualcomposer&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2516Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2778808%40visualcomposer&new=2778808%40visualcomposer&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2516Third Party Advisory

Published

Sep 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25154A DLL hijacking vulnerability in Samsung portable SSD T5 PC …7.3
• CVE-2022-25155Use of Password Hash Instead of Password for Authentication …8.1
• CVE-2022-25156Use of Weak Hash vulnerability in Mitsubishi Electric MELSEC…8.1
• CVE-2022-25157Use of Password Hash Instead of Password for Authentication …9.1
• CVE-2022-25158Cleartext Storage of Sensitive Information vulnerability in …9.1
• CVE-2022-25159Authentication Bypass by Capture-replay vulnerability in Mit…8.1
• CVE-2022-25160Cleartext Storage of Sensitive Information vulnerability in …5.9
• CVE-2022-25161Improper Input Validation vulnerability in Mitsubishi Electr…8.6
• CVE-2022-25162Improper Input Validation vulnerability in Mitsubishi Electr…5.3
• CVE-2022-25163Improper Input Validation vulnerability in Mitsubishi Electr…9.8
• CVE-2022-25164Cleartext Storage of Sensitive Information vulnerability in …7.5
• CVE-2022-25165An issue was discovered in Amazon AWS VPN Client 2.0.0. A TO…7