Description

The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwp_raw_shortcode' shortcode in all versions up to, and including, 1.0.5. This is due to the shortcode handler decoding Base64-encoded content and outputting it directly without any sanitization or escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The Base64 encoding allows the payload to bypass WordPress's KSES content filtering at save time, since the encoded string contains no harmful HTML characters.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-19T08:16:53.747Z",
  "pubdate": "2026-09-19T08:16:53.747Z",
  "executiveSummary": "The WP Composer – The Easiest Page Builder plugin for WordPress, in versions up to and including 1.0.5, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability originates from improper handling of user-supplied input within the 'pbwp_raw_shortcode' shortcode handler, allowing authenticated attackers to execute arbitrary JavaScript in the context of a victim's browser session.\nBy leveraging Base64 encoding, attackers can bypass WordPress KSES sanitization filters during the save process, effectively storing malicious payloads within page content.\nThe attack requires authenticated access at a Contributor level or higher, granting an attacker the ability to inject scripts that trigger upon page access.\nSuccessful exploitation allows for potential unauthorized actions, session hijacking, or defacement by compromising the security integrity of the WordPress environment.\nThe risk is categorized as significant due to the potential for privilege escalation or administrative account takeover when targeting users with higher access levels.",
  "technicalDetails": "The vulnerability resides in the processing logic of the 'pbwp_raw_shortcode' shortcode, which fails to implement appropriate output encoding or input sanitization for user-provided data.\nThe core mechanism of this vulnerability is the decoding of Base64-encoded strings within the shortcode's handler function. WordPress utilizes the KSES library to filter content during the saving process; however, because the malicious payload is represented as a Base64 string, the filter mechanism fails to recognize or neutralize the underlying malicious HTML tags or JavaScript.\nExploitation proceeds through the following steps: First, an attacker with at least Contributor-level privileges creates or edits a post. Second, the attacker inserts the 'pbwp_raw_shortcode' into the content body, setting the shortcode parameter to a Base64-encoded string containing an XSS payload (e.g., <script>alert(1)</script> encoded to base64). Third, the post is saved, and the encoded payload successfully bypasses the KSES filter because it consists of benign alphanumeric characters.\nUpon rendering the page, the plugin's shortcode handler executes, decoding the Base64 input into raw HTML/JavaScript. Since the output is rendered directly into the Document Object Model (DOM) without prior sanitization via functions like esc_js(), esc_html(), or wp_kses_post(), the injected script executes within the context of the user viewing the affected page.\nThe impact includes, but is not limited to, the execution of arbitrary JavaScript, which can be utilized to steal session cookies, perform unauthorized actions on behalf of the victim, or redirect users to malicious domains.\nThe affected component is the shortcode processing engine of the WP Composer plugin. The vulnerability is present in all versions up to 1.0.5. No input validation is applied to the output of the base64_decode() call, leading to a permanent storage of malicious script blocks in the database. This renders every user who views an infected page a potential target, regardless of their own role, assuming the script has the requisite functionality to interact with the WordPress API or administrative interfaces."
}