{"id":"CVE-2026-119073","kind":"vulnerability","aliases":["CVE-2026-119073"],"related":[],"title":"Live Composer WordPress plugin: stored XSS via pagination shortcode setting","description":"The Live Composer  WordPress plugin before 2.1.23 does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.","summary":"The Live Composer WordPress page builder plugin before 2.1.23 does not escape a pagination setting in its post-listing shortcodes when outputting it into an HTML attribute. A user with the Contributor role or higher can store a script that runs in other users' browsers.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["live-composer","package","self-hosted","wordpress"],"not_affected_if":["no-contributor-users","plugin-version-2.1.23-or-later","shortcode-unused"],"how_to_check":"- Check the installed Live Composer version in the WordPress admin plugin list or the plugin header in `wp-content/plugins/live-composer-page-builder/`\n- Look for post-listing shortcodes with a pagination attribute in post content, if the team can search the database\n- Compare the installed version against `2.1.23`","fix":"- Live Composer plugin: `2.1.23` (fixed in versions before 2.1.23 is the reported issue; upgrade to `2.1.23` or later)","status":"open","published_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:26+00:00","updated_at":"2026-11-07T06:48:26+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T06:48:26Z","model":"claude-haiku-5-5","output":{"fix":"- Live Composer plugin: `2.1.23` (fixed in versions before 2.1.23 is the reported issue; upgrade to `2.1.23` or later)","reach":"internet","title":"Live Composer WordPress plugin: stored XSS via pagination shortcode setting","impact":"medium","summary":"The Live Composer WordPress page builder plugin before 2.1.23 does not escape a pagination setting in its post-listing shortcodes when outputting it into an HTML attribute. A user with the Contributor role or higher can store a script that runs in other users' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","live-composer","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Stored script runs in visitors' and editors' browsers on the site","analyst_note":"","how_to_check":"- Check the installed Live Composer version in the WordPress admin plugin list or the plugin header in `wp-content/plugins/live-composer-page-builder/`\n- Look for post-listing shortcodes with a pagination attribute in post content, if the team can search the database\n- Compare the installed version against `2.1.23`","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-2.1.23-or-later","no-contributor-users","shortcode-unused"],"who_is_affected":"Sites running the Live Composer plugin before 2.1.23 where Contributor-level or higher users can create content. The flaw sits in the post-listing module shortcodes, so sites that do not use those shortcodes are less exposed. Sites where only trusted administrators write content carry less risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00073,"input_tokens":4211,"output_tokens":617,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119073':13A,16A '-2026':12A,15A '2.1.23':33B,77C 'allow':99C 'attack':114C 'attribut':52B,98C 'browser':70B 'builder':30B 'compos':2A,19B,27B,73C 'contributor':57B,103C 'cross':111C 'cross-sit':110C 'cve':11A,14A 'escap':36B,80C 'higher':60B 'host':23B 'html':51B,97C 'list':44B,89C 'live':1A,18B,26B,72C 'live-compos':17B 'modul':90C 'output':47B,93C 'packag':20B 'page':29B 'pagin':8A,38B,82C 'perform':108C 'plugin':4A,31B,75C 'post':43B,88C 'post-list':42B,87C 'role':58B,104C 'run':66B 'script':64B,113C 'self':22B 'self-host':21B 'set':10A,39B,83C 'shortcod':9A,45B,91C 'site':112C 'store':5A,62B,109C 'suppli':84C 'user':54B,69B,100C 'via':7A 'wordpress':3A,24B,28B,74C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Live Composer plugin before 2.1.23 where Contributor-level or higher users can create content. The flaw sits in the post-listing module shortcodes, so sites that do not use those shortcodes are less exposed. Sites where only trusted administrators write content carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["livecomposer","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119073':13A,16A '-2026':12A,15A 'compos':2A 'cve':11A,14A 'live':1A 'pagin':8A 'plugin':4A 'set':10A 'shortcod':9A 'store':5A 'via':7A 'wordpress':3A 'xss':6A","search_b":"'2.1.23':33B 'attribut':52B 'browser':70B 'builder':30B 'compos':19B,27B 'contributor':57B 'escap':36B 'higher':60B 'host':23B 'html':51B 'list':44B 'live':18B,26B 'live-compos':17B 'output':47B 'packag':20B 'page':29B 'pagin':38B 'plugin':31B 'post':43B 'post-list':42B 'role':58B 'run':66B 'script':64B 'self':22B 'self-host':21B 'set':39B 'shortcod':45B 'store':62B 'user':54B,69B 'wordpress':24B,28B","search_c":"'2.1.23':77C 'allow':99C 'attack':114C 'attribut':98C 'compos':73C 'contributor':103C 'cross':111C 'cross-sit':110C 'escap':80C 'html':97C 'list':89C 'live':72C 'modul':90C 'output':93C 'pagin':82C 'perform':108C 'plugin':75C 'post':88C 'post-list':87C 'role':104C 'script':113C 'set':83C 'shortcod':91C 'site':112C 'store':109C 'suppli':84C 'user':100C 'wordpress':74C","first_public_at":"2026-11-07T06:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119073","severity":null,"published_at":"2026-11-07T06:16:57+00:00","modified_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}