Description

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-01T05:17:08.847Z",
  "pubdate": "2026-09-01T05:17:08.847Z",
  "executiveSummary": "The Live Composer – Free WordPress Website Builder plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 2.1.19. This vulnerability stems from inadequate input sanitization and output escaping within the dslc_custom_field shortcode.\nThe flaw allows authenticated users with contributor-level privileges or higher to inject malicious JavaScript into web pages. When these pages are accessed by other users, including administrators, the injected scripts execute within the context of their browsers. This vulnerability poses a significant security risk, as it enables unauthorized actions, session hijacking, defacement, or the theft of sensitive session data, potentially leading to full site compromise if administrative sessions are compromised.",
  "technicalDetails": "The vulnerability resides within the processing logic of the dslc_custom_field shortcode in the Live Composer plugin. The core issue is an improper handling of user-supplied input provided via shortcode attributes. The plugin fails to adequately sanitize this input during the saving process, nor does it perform context-aware output escaping when rendering the data back to the browser.\nAn authenticated user with contributor-level access can manipulate the dslc_custom_field shortcode attributes to embed arbitrary HTML or JavaScript payloads. Because the plugin does not properly validate or sanitize these parameters, the malicious payload is stored persistently in the WordPress database.\nWhen a victim, such as an administrator or another user with higher privileges, views a post or page containing this compromised shortcode, the server renders the stored malicious script directly into the page source. Consequently, the victim's browser executes the script automatically under the context of the WordPress session.\nThe attack flow proceeds as follows: 1) The attacker identifies a target page or post where the dslc_custom_field shortcode is utilized. 2) The attacker, possessing at least contributor-level access, inserts a crafted shortcode containing an XSS payload (e.g., <script>alert('XSS')</script> or more malicious code for cookie theft) into the post content. 3) The plugin processes and saves this input without sufficient sanitization. 4) A victim views the affected page, causing the browser to render the stored payload. 5) The script executes within the victim's session, potentially allowing the attacker to perform unauthorized actions on behalf of the victim, exfiltrate sensitive data, or perform further administrative actions if the victim is an administrator.\nThis vulnerability is classified as Stored XSS because the payload is permanently stored on the server. The impact is significant as it facilitates client-side attacks that bypass standard server-side security controls, turning an authenticated low-privilege user into a vector for higher-privilege compromise."
}