PT-2026-145019

CVE-2026-119531

Published

2026-11-11

Updated

2026-11-11

Description by

CVSS 3.1

6.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder shortcodes before outputting them inside HTML tag attributes, allowing users with the Contributor role and above to store a payload that executes in the browser of anyone who views the post, including an administrator reviewing the pending submission.

Exploitability

Exploit

Fix

Impacts

Researchers

Claudio Marchesini

Dottor Marc

Enrico Marcolini

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')