CVE-2026-119073 · Package
NO FIX YET · SEE WHAT TO DO
The Live Composer WordPress page builder plugin before 2.1.23 does not escape a pagination setting in its post-listing shortcodes when outputting it into an HTML attribute. A user with the Contributor role or higher can store a script that runs in other users' browsers.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Live Composer plugin before 2.1.23 where Contributor-level or higher users can create content. The flaw sits in the post-listing module shortcodes, so sites that do not use those shortcodes are less exposed. Sites where only trusted administrators write content carry less risk.
Not affected if no-contributor-users, plugin-version-2.1.23-or-later, shortcode-unused
Who cares live-composer, self-hosted, wordpress
wp-content/plugins/live-composer-page-builder/2.1.232.1.23 (fixed in versions before 2.1.23 is the reported issue; upgrade to 2.1.23 or later)The Live Composer WordPress plugin before 2.1.23 does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.