CVE-2026-13203

Name of the Vulnerable Software and Affected Versions Live Composer – Free WordPress Website Builder versions prior to 2.1.20

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of the custom id shortcode attribute within the dslc modules section and dslc modules area shortcodes. The attribute is concatenated into the HTML id attribute of the rendered div element in the dslc modules section front() and dslc modules area front() functions without using esc attr(). Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages that execute when a user visits the affected page.

Recommendations Update to a version newer than 2.1.19. Restrict the use of the custom id attribute in dslc modules section and dslc modules area shortcodes until the update is applied.