CVE-2026-119073: Live Composer < 2.1.23 - Contributor+ Stored XSS via Post Module Pagination

Q: Who can exploit this issue?

A user with the WordPress Contributor role or any higher-privileged role can exploit it by supplying a malicious pagination setting through Live Composer post-listing module shortcodes.

Q: What conditions are required for exploitation?

The affected site must use a Live Composer version earlier than 2.1.23 and allow an attacker to create or modify content containing the relevant post-listing module shortcode. Exploitation requires an authenticated account with at least Contributor privileges.

Q: How can I determine whether my site is affected?

Check the installed Live Composer plugin version. Versions before 2.1.23 are affected; review content created by Contributors and higher roles for post-listing module shortcodes with suspicious pagination attribute values.

Published Nov 7, 2026

Updated

The Live Composer WordPress plugin before 2.1.23 does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A user with the WordPress Contributor role or any higher-privileged role can exploit it by supplying a malicious pagination setting through Live Composer post-listing module shortcodes.

What conditions are required for exploitation?

The affected site must use a Live Composer version earlier than 2.1.23 and allow an attacker to create or modify content containing the relevant post-listing module shortcode. Exploitation requires an authenticated account with at least Contributor privileges.

How can I determine whether my site is affected?

Check the installed Live Composer plugin version. Versions before 2.1.23 are affected; review content created by Contributors and higher roles for post-listing module shortcodes with suspicious pagination attribute values.

CVE-2026-119073: Live Composer < 2.1.23 - Contributor+ Stored XSS via Post Module Pagination

Event History

Frequently Asked Questions

Who can exploit this issue?

What conditions are required for exploitation?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What conditions are required for exploitation?

How can I determine whether my site is affected?