CVE-2026-13203
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Live Composer – Free WordPress Website Builder plugin is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute in versions up to and including 2.1.19. Insufficient output escaping allows authenticated attackers with contributor-level access to inject arbitrary scripts into the HTML id attribute, which execute when the page is accessed.
Risk Assessment
The risk involves execution of malicious scripts in the page context, potentially leading to data theft, session hijacking, or further attacks on users.
Recommendation
Update the plugin to the latest patched version. Also, restrict user privileges to the minimum necessary.
Other vulnerabilities in Live Composer plugin
Original NVD description (English source)
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute of the dslc_modules_section and dslc_modules_area shortcodes in versions up to, and including, 2.1.19. This is due to insufficient input sanitization and output escaping on the user-supplied attribute, which is concatenated into the HTML id="" attribute of the rendered <div> element in the dslc_modules_section_front() and dslc_modules_area_front() functions without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS