Executive brief
Live Composer is a popular WordPress page builder plugin used by site owners to create and edit web pages visually. The plugin fails to properly validate user input in shortcode attributes, allowing authenticated contributors to inject malicious scripts that execute whenever anyone visits the affected page. This can be used to steal admin credentials, deface content, or compromise visitor accounts.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the dslc_modules_section and dslc_modules_area shortcodes. The 'custom_id' attribute is concatenated directly into HTML id="" attributes without using WordPress's esc_attr() function for output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary JavaScript into the custom_id parameter, which persists in the database and executes in the browsers of all users who view the page. The vulnerability requires authentication but not administrator privileges, making it accessible to lower-privileged users.
Affected products
- Live Composer Free WordPress Website Builder up to and including 2.1.19
Timeline
- 2026-09-01: disclosed