PT-2026-145019

CVE-2026-119531

Publicado

2026-11-11

Atualizado

2026-11-11

Descrição por

CVSS 3.1

6.8

Média

MétricasAV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder shortcodes before outputting them inside HTML tag attributes, allowing users with the Contributor role and above to store a payload that executes in the browser of anyone who views the post, including an administrator reviewing the pending submission.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Claudio Marchesini

Dottor Marc

Enrico Marcolini

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')