CVE-2026-119531: Live Composer < 2.1.24 - Contributor+ Stored XSS via Module Area Shortcode
The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder shortcodes before outputting them inside HTML tag attributes, allowing users with the Contributor role and above to store a payload that executes in the browser of anyone who views the post, including an administrator reviewing the pending submission.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the WordPress Contributor role or any higher-privileged role can store a malicious payload through the affected page-builder shortcode.
Does an attacker need to publish content for the payload to run?
No. The payload can execute when someone views the affected post, including when an administrator reviews a pending submission.
Which installations are affected?
Live Composer versions before 2.1.24 are affected. The provided information does not identify any configuration prerequisite beyond use of the vulnerable shortcode.