EUVD-2026-68975
GHSA-vhjj-j285-vx8j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L reflects required contributor access; UI:R corrects the provided UI:N because victims must actively visit the injected page to trigger payload execution, consistent with stored XSS semantics.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Live Composer - Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Live Composer WordPress page builder plugin (all versions through 2.1.19) allows authenticated contributors to inject persistent JavaScript payloads via the dslc_custom_field shortcode, executing in any visitor's browser session. Wordfence identified insufficient input sanitization and output escaping in shortcodes.php at multiple code paths (lines 84, 88, 89). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a contributor-level WordPress account (or higher: author, editor, administrator) on the target site - unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD/Wordfence CVSS score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) correctly captures the network-accessible, low-complexity attack path and the scope change to the victim's browser, but the UI:N metric is debatable for stored XSS - standard CVSS 3.1 guidance typically assigns UI:R to payloads that require a victim to visit the injected page, which applies here. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Live Composer plugin to a version above 2.1.19 - a remediation changeset (revision 3662813) is available in the WordPress plugin SVN repository at https://plugins.trac.wordpress.org/changeset?reponame=&old=3662813%40live-composer-page-builder&new=3662813%40live-composer-page-builder, though the exact patched release version number is not independently confirmed from the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in the Live Composer - Free WordPress Website Builder plugin (all versions through 2.1.19) l
Stored cross-site scripting in the Live Composer Free WordPress Website Builder plugin (all versions up to and including
Stored Cross-Site Scripting in Live Composer Free WordPress Website Builder (versions ≤ 2.1.19) allows authenticated con
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today