Description

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time wp_kses_post check is bypassed because the payload is stored as a serialized string containing no HTML tags for kses to tokenize, and the shortcode callback re-emits attacker-controlled values — including view_all_link (href attribute), main_heading_title (h2 body), button_text (anchor body), and button_inline_svg (anchor body) — without any escaping at render time.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-22T08:16:38.800Z",
  "pubdate": "2026-09-22T08:16:38.800Z",
  "executiveSummary": "The Live Composer – Free WordPress Website Builder plugin, in all versions up to and including 2.1.21, contains a Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability stems from inadequate input sanitization and output escaping within the 'dslc_module_downloads_output' shortcode.\nThe flaw allows an authenticated attacker with contributor-level permissions or higher to inject arbitrary JavaScript into WordPress pages.\nUpon execution, the injected scripts run within the context of the victim's session, potentially leading to unauthorized actions, session hijacking, or defacement.\nThe vulnerability is particularly critical as it bypasses standard security filters like wp_kses_post through the manipulation of serialized data structures.\nSuccessful exploitation requires the attacker to have at least contributor-level access to the WordPress site, enabling them to leverage the plugin's shortcode functionality to store malicious payloads.\nOrganizations using this plugin are at risk of compromise if they allow users with contributor access to manage content via Live Composer.",
  "technicalDetails": "The vulnerability resides in the 'dslc_module_downloads_output' shortcode callback mechanism within the Live Composer plugin. The core issue is a failure to perform adequate input sanitization during data storage and, more critically, a failure to implement output escaping during the rendering process.\nDuring the save operation, the plugin attempts to secure data using 'wp_kses_post'. However, this control is bypassed because the malicious payload is embedded within a serialized string. Because the payload does not initially contain HTML tags that the kses filter would identify as invalid, the data is committed to the database in a 'sanitized' but dangerous state.\nThe exploitation flow begins when an authenticated user with contributor-level privileges or higher creates or edits a page using the Live Composer interface. The attacker targets specific shortcode attributes, including 'view_all_link', 'main_heading_title', 'button_text', and 'button_inline_svg'.\nBy crafting a payload containing malicious JavaScript—often disguised as URI schemes (e.g., 'javascript:alert(1)') for 'href' attributes or script tags for body content—the attacker successfully injects arbitrary code. When the WordPress engine invokes the 'dslc_module_downloads_output' function to render the page, the plugin outputs these attacker-controlled variables directly into the HTML document object model (DOM) without applying appropriate sanitization or context-aware output escaping functions like esc_url(), esc_html(), or esc_attr().\nOnce the rendered page is accessed by a victim, the browser interprets the injected payload as legitimate script execution. This behavior results in a Stored XSS attack, which is executed automatically without requiring further interaction from the victim beyond simply viewing the compromised page.\nThe post-exploitation impact includes the execution of arbitrary JavaScript in the victim's browser context. Depending on the victim's privilege level, this could allow an attacker to hijack administrative sessions, perform unauthorized administrative actions, redirect users, or exfiltrate sensitive site data.\nThe vulnerability affects all plugin versions up to and including 2.1.21, as the rendering logic fails to validate or encode data retrieved from the database before it is emitted into the client-side environment."
}