EUVD-2026-68976
GHSA-q744-rpmq-q2gw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires victim to visit the injected page (UI:R); Contributor authentication required (PR:L); scope changes to victim browser (S:C).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Live Composer - Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute of the dslc_modules_section and dslc_modules_area shortcodes in versions up to, and including, 2.1.19. This is due to insufficient input sanitization and output escaping on the user-supplied attribute, which is concatenated into the HTML id="" attribute of the rendered <div> element in the dslc_modules_section_front() and dslc_modules_area_front() functions without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in Live Composer Free WordPress Website Builder (versions ≤ 2.1.19) allows authenticated contributors to permanently embed arbitrary JavaScript into WordPress pages via the unsanitized 'custom_id' shortcode attribute. The payload is rendered verbatim into the HTML id="" attribute of div elements by dslc_modules_section_front() and dslc_modules_area_front() due to absent esc_attr() output escaping, then executes in the browser of every subsequent visitor - including administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress user account at Contributor level or above - unauthenticated attackers cannot exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N = 6.4) warrants scrutiny: UI:N is atypical for stored XSS because a victim must browse to the injected page to trigger execution - standard CVSS guidance typically assigns UI:R in this scenario. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The upstream fix is available as WordPress SVN changeset 3662813 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3662813%40live-composer-page-builder&new=3662813%40live-composer-page-builder); administrators should update to the patched plugin version via the WordPress dashboard (Dashboard → Plugins → Updates). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in the Live Composer - Free WordPress Website Builder plugin (all versions through 2.1.19) l
Stored cross-site scripting in the Live Composer Free WordPress Website Builder plugin (all versions up to and including
Stored Cross-Site Scripting in the Live Composer WordPress page builder plugin (all versions through 2.1.19) allows auth
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today