CVE-2026-119531 · Package
NO FIX YET · SEE WHAT TO DO
The Live Composer WordPress plugin before 2.1.24 fails to escape several shortcode attributes when it prints them into HTML. A user with Contributor access can store a payload that runs in the browser of anyone who views the post, including an administrator reviewing it.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Live Composer WordPress plugin before 2.1.24 that let Contributor-level users write posts. The flaw sits in page-builder shortcode output, so sites without Live Composer shortcodes or with only trusted authors are less exposed. Sites that do not run the plugin can skip it.
Not affected if no-contributor-users, plugin-2.1.24-or-later, plugin-not-installed
Who cares live-composer, self-hosted, wordpress
2.1.24 is affected.2.1.24 or later.The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder shortcodes before outputting them inside HTML tag attributes, allowing users with the Contributor role and above to store a payload that executes in the browser of anyone who views the post, including an administrator reviewing the pending submission.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.