CVE-2026-2422

Name of the Vulnerable Software and Affected Versions WP Composer – The Easiest Page Builder versions prior to 1.0.6

Description Stored Cross-Site Scripting occurs via the pbwp raw shortcode shortcode. The shortcode handler decodes Base64-encoded content and outputs it directly without sanitization or escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. Because the payload is Base64 encoded, it bypasses KSES (a WordPress content filtering system) during the save process as the encoded string lacks harmful HTML characters. The scripts execute whenever a user visits the affected page.

Recommendations Update WP Composer – The Easiest Page Builder to version 1.0.6 or later. As a temporary mitigation, restrict the use of the pbwp raw shortcode shortcode.