Executive brief
The Live Composer WordPress plugin is a popular website building tool used by non-technical site administrators to create and manage web pages. The plugin fails to properly sanitize user input in custom field shortcodes, allowing authenticated contributors to inject malicious scripts that execute when other users view affected pages. This could enable account takeover, defacement, or malware distribution to site visitors.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the 'dslc_custom_field' shortcode handler, resulting from insufficient input sanitization and output escaping. An authenticated attacker with contributor-level or higher permissions can inject arbitrary JavaScript code into shortcode parameters; the unescaped payload is stored in the database and executed in the browsers of all users who view the affected page. The attack requires existing authentication but no further user interaction. Patches are available in versions after 2.1.19.
Affected products
- Live Composer Free WordPress Website Builder up to 2.1.19
Timeline
- 2026-09-01: disclosed