EUVD-2026-68998
GHSA-vq42-9gx3-gj3v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor-level auth required (PR:L); victim must actively visit the injected page (UI:R); payload executes in victim browser scope (S:C); no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Live Composer - Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives save-time wp_kses_post filtering because KSES treats shortcode delimiters as opaque, and the unescaped fields - including main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all - are only rendered when do_shortcode() executes at page-view time.
AnalysisAI
Stored cross-site scripting in the Live Composer Free WordPress Website Builder plugin (all versions up to and including 2.1.19) allows authenticated attackers with contributor-level access to embed persistent JavaScript payloads via the dslc_module_testimonials_output shortcode. The vulnerability exploits a two-phase rendering gap: WordPress's native wp_kses_post filter sanitizes content at save time but treats shortcode markup as opaque, so attacker-controlled values in fields such as main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all are never escaped - they reach the DOM unfiltered when do_shortcode() executes at page-view time. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at least contributor-level permissions - this is the primary gate and the main limiting factor against opportunistic mass exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N reflects a network-reachable, low-complexity attack constrained by a contributor-level authentication prerequisite and producing a scope change - the injected payload executes in other users' browser sessions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (changeset 3662813 in the WordPress plugin repository); the exact patched release version number is not confirmed from available reference data - site administrators should update the Live Composer plugin to the latest available version immediately via the WordPress admin dashboard or WP-CLI and verify the installed version exceeds 2.1.19. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in the Live Composer - Free WordPress Website Builder plugin (all versions through 2.1.19) l
Stored Cross-Site Scripting in Live Composer Free WordPress Website Builder (versions ≤ 2.1.19) allows authenticated con
Stored Cross-Site Scripting in the Live Composer WordPress page builder plugin (all versions through 2.1.19) allows auth
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today