Executive brief
WP Composer is a page builder plugin for WordPress that allows content creators to design pages visually. The plugin contains a stored cross-site scripting flaw in its shortcode handler that lets authenticated contributors inject malicious scripts into pages. When other users view these compromised pages, the scripts execute in their browsers, potentially allowing attackers to steal session cookies, deface content, or redirect users to malicious sites.
Technical details
The 'pbwp_raw_shortcode' shortcode handler decodes Base64-encoded content and outputs it without sanitization or escaping, allowing authenticated attackers to bypass WordPress KSES filtering. An attacker with Contributor-level access or higher can inject arbitrary JavaScript payloads into pages via the shortcode, which execute whenever users access those pages. The vulnerability affects all versions up to and including 1.0.5.
Affected products
- WP Composer WP Composer up to 1.0.5
Timeline
- 2026-09-19: disclosed