Executive brief
The Live Composer page builder plugin for WordPress contains a flaw that allows authenticated users with contributor access to inject malicious scripts into pages. When visitors view a page containing an injected script, it will execute in their browser, potentially stealing session data, redirecting users, or performing actions on their behalf. The vulnerability affects all versions up to 2.1.19.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the dslc_module_projects_output shortcode handler. The root cause is insufficient input sanitization and output escaping of user-supplied parameters such as view_all_link, main_heading_link_title, main_filter_title_all, and button_text. WordPress's shortcode processing preserves serialized shortcode bodies as placeholders before content filtering, allowing attacker-controlled values to bypass sanitization and reach the render-time output sink unescaped. An authenticated attacker with contributor-level or higher privileges can inject arbitrary JavaScript into pages via the affected shortcode parameters. When other users access these pages, the injected script executes in their browser context. A patch is required to properly escape or sanitize these parameters at output time.
Affected products
- Live Composer Free WordPress Website Builder up to and including 2.1.19
Timeline
- 2026-09-01: disclosed