Executive brief
The Live Composer website builder plugin for WordPress contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious scripts into page content. When other users visit an affected page, the injected scripts execute in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability bypasses security checks by storing payloads as serialized data that escapes initial filtering, then outputs them unescaped during page rendering.
Technical details
The vulnerability exists in the downloads module's shortcode handler, which fails to escape output from attacker-controlled attributes (view_all_link, main_heading_title, button_text, button_inline_svg) when rendering page content. An authenticated attacker with contributor-level access can bypass initial wp_kses_post sanitization by storing payloads as serialized strings that contain no HTML tags for the filter to detect, exploiting the gap between save-time validation and render-time output emission. This stored XSS executes whenever any user accesses the compromised page.
Affected products
- Live Composer Free WordPress Website Builder up to and including 2.1.21
Timeline
- 2026-09-22: disclosed