Description

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives save-time wp_kses_post filtering because KSES treats shortcode delimiters as opaque, and the unescaped fields — including main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all — are only rendered when do_shortcode() executes at page-view time.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-01T10:17:11.603Z",
  "pubdate": "2026-09-01T10:17:11.603Z",
  "executiveSummary": "The Live Composer – Free WordPress Website Builder plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from inadequate input sanitization and output escaping within the dslc_module_testimonials_output shortcode. The vulnerability affects all versions up to and including 2.1.19.\nSuccessful exploitation allows authenticated users with contributor-level privileges or higher to inject malicious JavaScript payloads into website content. When an unsuspecting user, such as an administrator or visitor, accesses a page containing the compromised shortcode, the injected script executes within the victim's browser context. This may lead to unauthorized actions performed on behalf of the user, potential session hijacking, or defacement of the affected WordPress site. Given the privilege level requirement of a Contributor, the threat is categorized as a significant risk to site integrity and user security, necessitating prompt remediation.",
  "technicalDetails": "The root cause of this vulnerability is the failure to properly sanitize user-supplied input or escape rendered output within specific shortcode attributes handled by the dslc_module_testimonials_output function. The affected input fields include 'main_heading_title', 'view_all_link', 'main_heading_link_title', and 'main_filter_title_all'.\nDuring the save process, WordPress typically employs 'wp_kses_post' to sanitize content. However, the plugin fails to prevent the inclusion of malicious scripts because the KSES filter treats the internal content of shortcodes as opaque strings. Consequently, the payload is successfully stored in the database without being stripped or neutralized. The malicious script remains dormant until the 'do_shortcode()' function is invoked during the rendering of a page or post. At this execution time, the plugin outputs the stored attributes directly into the HTML document without secondary escaping, allowing the browser to interpret and execute the injected JavaScript.\nThe attack flow proceeds as follows: First, an authenticated attacker with contributor privileges initiates the creation or modification of a page or post. Second, the attacker inserts the 'dslc_module_testimonials_output' shortcode and populates the vulnerable attributes with a crafted XSS payload (e.g., <script>alert('XSS')</script>). Third, the attacker saves the content; the payload bypasses initial KSES filtering and persists in the WordPress database. Fourth, when a site administrator or a standard visitor views the rendered page, the server-side execution of 'do_shortcode()' processes the attributes, embedding the malicious script into the final HTML output. Finally, the victim's browser executes the payload, which could involve stealing authentication cookies, redirecting the user, or performing unauthorized administrative actions via forged requests (CSRF).\nThis vulnerability is classified as Stored XSS because the malicious code resides permanently on the server-side infrastructure within the WordPress database until the content is manually removed or the plugin is updated. The vulnerability exposure is restricted to environments where users have at least 'Contributor' access, making it a critical concern for multi-author WordPress installations using the Live Composer plugin."
}