Some people may have seen me comment about this a lot of times but it needs bringing back up.
Visual Composer needs to be updated to fix issues with the plugin, but authors seem to have missed the notifications from Envato and now their items are being disabled, buyers sites are now "potentially" insecure until they are able to get hold of an updated copy of VC.
Items shouldn't bundle plugins
It may seem obvious but you should never ever bundle other authors plugins in your items as you then (as the author) become responsible for updating your items. The only reason bundling became popular as a couple authors did it to gain an advantage and now buyers and authors want this to happen.
There are major cons to bundling plugins including:
buyers need to keep updating the plugin separately
the plugin has to be downloaded within a theme
if the author stops supporting their item, buyers can have a vulnerable plugin without a way to get it updated without buying a separate license.
authors become support for the plugin, they have to keep updates on the plugin to their buyers.
Stop bundling plugins
I am fortunate that I only have around 20 sites with VC on and I have updated the majority but it's a lot of work for something that shouldn't have been allowed to happen.
I know some plugin authors don't allow extended sales so they aren't brought into mess like this
WPML is probably the most common plugin which doesn't allow bundling, but authors can show they support the plugin, Codecanyon plugins should be the same, authors can show "we support Visual Composer & Revolution Slider".
Buyers can then buy a license from CC to go with their theme, buyers then get auto updates from the plugin author, update when they want and get support from the plugin author.
Buyers pay more in the long run for their items but they get far better support so issues like this won't happen again as it's actually becoming quite common (rev slider had the same issue).
Envato please ban bundling of plugins.... your buyers deserve better.