Executive brief
The Live Composer WordPress page builder plugin allows authenticated users with contributor-level permissions to inject malicious scripts into website pages through a testimonials component. When other users view the affected pages, these injected scripts execute in their browsers, potentially compromising their accounts or stealing sensitive data. This vulnerability affects all versions up to 2.1.19.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the dslc_module_testimonials_output shortcode handler. It stems from insufficient input sanitization and output escaping of several fields including main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all. The vulnerability persists because WordPress KSES filtering (wp_kses_post) treats shortcode delimiters as opaque, allowing malicious payloads to survive sanitization at save time. The unescaped fields are only rendered when do_shortcode() executes during page view, at which point the injected script runs. An authenticated attacker with contributor-level access or higher can exploit this to inject arbitrary JavaScript that executes in the context of any user viewing the affected page.
Affected products
- DragDropBuilder Live Composer up to and including 2.1.19
Timeline
- 2026-09-01: disclosed