Live Composer EUVD-2026-84298

Requires an authenticated account with contributor-level access or above on a WordPress site running Live Composer - Free Website Builder (version <=2.1.21) with the Downloads module in use. The attacker must craft the payload as a serialized string containing no raw HTML tags so it passes the save-time wp_kses_post filter, and the injected content must be rendered via the dslc_module_downloads_output shortcode. Exploitation is limited by the need for a contributor+ account (no anonymous/unauthenticated path) and by the modest impact of stored XSS; a victim must subsequently visit the injected page for the script to fire, though no explicit click beyond page view is required (UI:N).

This is a genuine but moderate-severity issue, not an over-inflated high-CVSS case. The CVSS 6.4 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) is internally consistent with the description: network-reachable, low complexity, and requiring only contributor-level authentication (PR:L). The scope change (S:C) is appropriate for stored XSS since the injected script executes in the browser context of any visitor viewing the injected page, crossing a trust boundary from the low-privileged author to unrelated victims. No EPSS score, KEV listing, or public POC is provided, so there is no evidence of active exploitation - status is 'no public exploit identified at time of analysis.' The realistic risk driver is the low authentication bar (contributor is a self-registration-friendly role on many WP sites) combined with a persistent payload; however, the impact is capped at C:L/I:L (session/cookie theft, limited action-forcing) rather than full site takeover, so this should be prioritized as a standard authenticated stored-XSS remediation rather than an emergency. The notable technical nuance - worth verifying against the patch - is that the payload bypasses the save-time wp_kses_post filter by being stored as a serialized string with no HTML tags, then re-emitted unescaped at render time; this makes the vulnerability real even though a naive review of the save path would suggest sanitization is present.

An attacker registers or obtains a contributor-level account on a WordPress site running Live Composer, then crafts a Downloads module whose fields (e.g. view_all_link href, main_heading_title, button_text, or button_inline_svg) contain a serialized-string XSS payload that survives the wp_kses_post save-time check. When the shortcode callback renders the page, the attacker-controlled values are emitted without escaping. No public exploit code is identified, but the low complexity (AC:L) and modest privilege requirement (PR:L) make exploitation straightforward for any authenticated contributor.