EUVD-2026-68999
GHSA-mxp4-75jf-xp7h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor authentication required (PR:L); stored payload fires on normal page visit without further attacker interaction (UI:N); browser scope change (S:C) with limited confidentiality and integrity impact, no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Live Composer - Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_projects_output Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress's shortcode-aware kses handling preserves the serialized shortcode body as a placeholder before content filtering runs, allowing attacker-controlled values such as view_all_link, main_heading_link_title, main_filter_title_all, and button_text to reach render-time sinks entirely unescaped.
AnalysisAI
Stored Cross-Site Scripting in the Live Composer - Free WordPress Website Builder plugin (all versions through 2.1.19) lets authenticated contributors inject persistent JavaScript payloads via the dslc_module_projects_output shortcode, with those payloads executing in the browser of every subsequent page visitor including site administrators. The root mechanism is WordPress's shortcode-aware kses processing, which serializes and preserves shortcode bodies as opaque placeholders before content filtering runs, allowing attacker-controlled attributes - view_all_link, main_heading_link_title, main_filter_title_all, and button_text - to reach multiple render-time output sinks in the plugin's projects module entirely unescaped. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum contributor-level role (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.4 score reflects a meaningful balance of factors: network reachability (AV:N), low complexity (AC:L), low-privilege authentication requirement (PR:L for contributor role), no required attacker-side user interaction (UI:N), and a scope change (S:C) with low Confidentiality and Integrity impact on downstream systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to the latest available version of the Live Composer - Free WordPress Website Builder plugin from the official WordPress plugin directory, verifying the installed version exceeds 2.1.19. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored cross-site scripting in the Live Composer Free WordPress Website Builder plugin (all versions up to and including
Stored Cross-Site Scripting in Live Composer Free WordPress Website Builder (versions ≤ 2.1.19) allows authenticated con
Stored Cross-Site Scripting in the Live Composer WordPress page builder plugin (all versions through 2.1.19) allows auth
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today