Description

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_projects_output Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress's shortcode-aware kses handling preserves the serialized shortcode body as a placeholder before content filtering runs, allowing attacker-controlled values such as view_all_link, main_heading_link_title, main_filter_title_all, and button_text to reach render-time sinks entirely unescaped.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-01T10:17:11.740Z",
  "pubdate": "2026-09-01T10:17:11.740Z",
  "executiveSummary": "The Live Composer – Free WordPress Website Builder plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, classified as a security flaw in input validation and output encoding.\nThis vulnerability allows authenticated users with contributor-level access or higher to inject malicious JavaScript into web pages through the dslc_module_projects_output shortcode.\nWhen a user or administrator accesses a page containing the compromised shortcode, the injected script executes within the context of their session. This presents a significant risk, as it may lead to unauthorized actions, session hijacking, or the defacement of the affected WordPress site.\nThe vulnerability originates from the failure to properly sanitize input parameters within the shortcode, allowing malicious payloads to reach render-time sinks without appropriate escaping.\nSuccessful exploitation necessitates an authenticated account with at least contributor privileges, making this an internal threat vector that bypasses standard perimeter defenses.",
  "technicalDetails": "The vulnerability resides within the dslc_module_projects_output shortcode of the Live Composer plugin, affecting all versions up to and including 2.1.19. The root cause is the inadequate sanitization of user-supplied parameters and a subsequent failure to perform output escaping at the rendering stage.\nSpecifically, several attributes within the shortcode—including view_all_link, main_heading_link_title, main_filter_title_all, and button_text—are processed without sufficient filtering. WordPress employs a shortcode-aware kses mechanism that inadvertently preserves the serialized shortcode body. During content filtering, the plugin fails to sanitize these specific fields, allowing arbitrary data to be stored directly in the database.\nWhen the shortcode is processed during page rendering, these unescaped, attacker-controlled values are injected directly into the HTML output. An attacker with contributor access can craft a shortcode string containing malicious JavaScript payloads within the affected attributes. For example, injecting '<script>alert(document.cookie)</script>' into the button_text parameter results in that script being rendered as active HTML code when the page is viewed by any user, including high-privileged administrators.\nThe attack flow follows a structured path: First, the attacker creates or modifies a post or page using the WordPress editor, embedding the malicious dslc_module_projects_output shortcode with the weaponized parameters. Second, the plugin saves this raw, unsanitized input to the database. Third, when a victim—such as an administrator—visits the page containing the shortcode, the server retrieves the stored malicious payload from the database and renders it into the document object model (DOM) of the victim's browser without any transformation or encoding.\nBecause the script executes in the victim's browser context, the attacker can perform actions on behalf of the victim, such as modifying plugin configurations, creating new administrator accounts, or exfiltrating session tokens. The lack of validation ensures that any JavaScript successfully injected into these fields will be executed consistently upon every page load, establishing a persistent and reliable Stored XSS attack vector."
}