Skip to content
PluginCanary

Visual Composer Website Builder

by Visual Composer · 30,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: maintained, last release 7 Oct 2026, 94 releases in 24 months, no unpatched vulnerabilities.

81/ 100 Canary Score
Sub-scores for Visual Composer Website Builder
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Quick answers

Is Visual Composer Website Builder still maintained?
Yes. Last release 7 Oct 2026, 94 releases in the last 24 months. 7 Oct 2026 · wordpress.org
Who owns Visual Composer Website Builder, and has it changed hands?
No change recorded. Main committer visualcomposer since Sep 2019. 3 Nov 2026 · SVN log
Was Visual Composer Website Builder removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is Visual Composer Website Builder safe?
14 known vulnerabilities, all fixed (latest in 45.16.4). Not on the exploited list. 8 Oct 2026 · Wordfence Intelligence
Is the latest Visual Composer Website Builder update safe to install?
No ownership change before 45.16.4. No one-star spike after it. 7 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master25 Sep 2019 to 25 Sep 2019, 1 commits
visualcomposer26 Sep 2019 to 2 Nov 2026, 629 commits

2 committers recorded. No ownership change since 2019.

Maintenance

Last release
28 days ago
Releases, 24 months
94
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for Visual Composer Website Builder
Q1 20244
Q2 20241
Q3 20243
Q4 20240
Q1 20250
Q2 20252
Q3 202587
Q4 20250
Q1 20260
Q2 20260
Q3 20264
Q4 20261

Last release 7 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.6.

Average rating per quarter for Visual Composer Website Builder
Q1 20242.7
Q1 20251.0
Q3 20255.0
Q4 20255.0
Q1 20261.0
Q3 20262.0

Average rating fell from 2.7 to 2.0 between Q1 2024 and Q3 2026.

Rating distribution
5 star190
4 star6
3 star1
2 star4
1 star19
Latest low reviews

Security record

8 vulnerabilities in 24 months (14 on record), all patched (latest fixed in 45.16.4).

Show 14 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
8 Oct 2026Visual Composer Website Builder <= 45.16.3 - Missing Authorization4.3<= 45.16.345.16.4Patched before disclosure
30 Sep 2026Visual Composer Website Builder <= 45.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 45.16.245.16.3Patched before disclosure
23 Sep 2026Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter9.8<= 45.16.045.16.1Patched before disclosure
10 Sep 2026Visual Composer Website Builder <= 45.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 45.16.145.16.2Patched before disclosure
24 Jul 2026Visual Composer Website Builder <= 45.15.0 - Missing Authorization4.3<= 45.15.045.16.0Patched before disclosure
14 Aug 2025Visual Composer Website Builder <= 45.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 45.13.045.15.0Patched before disclosure
19 May 2025Visual Composer Website Builder <= 45.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 45.11.045.12.0Patched before disclosure
22 Apr 2025Visual Composer Website Builder <= 45.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 45.10.045.11.0Patched before disclosure
3 Jun 2024Visual Composer Website Builder <= 45.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting4.4<= 45.8.045.9.0Patched before disclosure
15 Mar 2024Visual Composer Website Builder <= 45.6.0 - Authenticated (Editor+) Stored Cross-Site Scripting4.4<= 45.6.045.7.0Patched before disclosure
29 Feb 2024Visual Composer Premium <= 45.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 45.6.045.7.0Patched before disclosure
29 Aug 2022Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Text Block'6.4<= 45.045.0.14
29 Aug 2022Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Title'6.4<= 45.045.0.14
18 May 2020Visual Composer <= 26.0 - Multiple Cross-Site Scripting5.5<= 26.027.01919

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

0% of 1 support threads resolved in the last 2 months.

Momentum

30,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Visual Composer Website Builder
4 May 2026626
11 May 2026965
18 May 2026986
25 May 2026903
1 Jun 2026913
8 Jun 2026916
15 Jun 2026923
22 Jun 2026845
29 Jun 2026823
6 Jul 2026864
13 Jul 2026837
20 Jul 202630,717
27 Jul 20265,251
3 Aug 20264,700
10 Aug 20262,291
17 Aug 20262,010
24 Aug 20262,184
31 Aug 20261,836
7 Sep 202617,476
14 Sep 20264,676
21 Sep 202619,615
28 Sep 20264,164
5 Oct 202620,375
12 Oct 20263,462
19 Oct 20263,696
26 Oct 20264,510
2 Nov 2026350

Weekly downloads over the last 4 weeks are 41% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Beaver Builder Page BuilderScore 83 · 100,000+Colibri Page BuilderScore 83 · 80,000+Kubio AI Page BuilderScore 83 · 80,000+Page BuilderScore 82 · 400,000+IbtanaScore 82 · 10,000+

Facts

Version45.16.4
AuthorVisual Composer
Added26 Sep 2019
Last updated7 Oct 2026
Active installs30,000+
Requires WordPress5.5
Tested up to7.1.4
Requires PHP7.4
CategoryDesign & Themes > Page Builders & Visual Editors
Tagspage builder, popup builder, theme builder, landing page builder, drag and drop website builder

Questions

Is Visual Composer Website Builder still maintained?

Yes. Last release 7 Oct 2026, 94 releases in the last 24 months.

Who owns Visual Composer Website Builder, and has it changed hands?

No change recorded. Main committer visualcomposer since Sep 2019.

Was Visual Composer Website Builder removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is Visual Composer Website Builder safe?

14 known vulnerabilities, all fixed (latest in 45.16.4). Not on the exploited list.

Is the latest Visual Composer Website Builder update safe to install?

No ownership change before 45.16.4. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue