WP Composer CVE-2026-2422

Requires an authenticated account with Contributor-level capability or above (PR:L) on a WordPress site running WP Composer - The Easiest Page Builder <=1.0.5, AND that the pbwp_raw_shortcode shortcode is usable in authored content. Exploitation specifically leverages the shortcode handler's Base64-decode-then-echo behavior to bypass WordPress KSES content filtering at save time. Realistic limiting factors: the attacker must already hold or be able to register a contributor+ role (so sites that do not grant untrusted users authoring capability are largely out of scope), and payload execution is deferred until a user (ideally a higher-privileged editor/admin) actually views the injected page - no direct server-side compromise occurs.

This is a moderate, not urgent, priority. CVSS 3.1 base 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a network-reachable but authentication-gated flaw: PR:L confirms an attacker needs a legitimate Contributor-level account or higher, which sharply narrows the population of viable attackers on a hardened site and makes this most relevant to multi-author blogs, membership sites, or environments with open/weak registration. The S:C scope change plus C:L/I:L captures classic stored-XSS impact - script executing in a victim's browser session in the security context of whoever views the injected page (potentially an admin), enabling session/cookie theft, admin-action forgery, or account takeover, but no direct host confidentiality/integrity/availability loss. No EPSS score, no CISA KEV entry, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active or automatable mass exploitation; SSVC-style triage would land near 'Track', not 'Act'. The notable technical wrinkle is the KSES-bypass mechanism (Base64-encoded payload passes WordPress content filtering at save time, then is decoded and echoed unsanitized), which makes the flaw reliably exploitable despite WP's normal author-content sanitization - a real, credible bug rather than a theoretical one. No signals conflict; the main caveat is that all intelligence derives from a single reporter (Wordfence) and the vendor source-code links, with no independent NVD enrichment (EPSS/KEV absent).

On a WordPress site that grants Contributor (or higher) accounts - e.g. a multi-author publication or a site with open registration mapped to a contributor role - an attacker authors a page/post embedding the pbwp_raw_shortcode with a Base64-encoded JavaScript payload, which slips past KSES filtering at save time. When an editor, administrator, or other visitor previews or opens that content, the plugin Base64-decodes and echoes the payload, executing arbitrary script in the victim's browser to hijack the session or perform privileged actions. No public exploit code is identified at time of analysis, but the technique is straightforward given the disclosed vulnerable code path.