Wp Composer The Easiest Page Builder
Monthly
Stored cross-site scripting in WP Composer - The Easiest Page Builder (Ghozylab) affects every release up to and including 1.0.5: the pbwp_raw_shortcode handler Base64-decodes its content and echoes it into the page without sanitization or escaping, so an attacker who can author content through the plugin can persist a script that runs in the browser of anyone who later views the page. Exploitation requires an authenticated account with Contributor-level capability or above (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N vector), and because the payload is Base64-encoded it contains no raw HTML characters at save time and therefore slips past WordPress's KSES content filtering - execution is deferred until a victim, ideally a higher-privileged editor or administrator, opens the injected page. Impact is limited to client-side script execution within the site origin (low confidentiality and integrity, no availability loss, no server-side compromise); no public exploit code or CISA KEV listing was identified at time of analysis, and consistent with the independent assessment this is a moderate, not urgent, priority.
Stored cross-site scripting in WP Composer - The Easiest Page Builder (Ghozylab) affects every release up to and including 1.0.5: the pbwp_raw_shortcode handler Base64-decodes its content and echoes it into the page without sanitization or escaping, so an attacker who can author content through the plugin can persist a script that runs in the browser of anyone who later views the page. Exploitation requires an authenticated account with Contributor-level capability or above (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N vector), and because the payload is Base64-encoded it contains no raw HTML characters at save time and therefore slips past WordPress's KSES content filtering - execution is deferred until a victim, ideally a higher-privileged editor or administrator, opens the injected page. Impact is limited to client-side script execution within the site origin (low confidentiality and integrity, no availability loss, no server-side compromise); no public exploit code or CISA KEV listing was identified at time of analysis, and consistent with the independent assessment this is a moderate, not urgent, priority.