{"id":"CVE-2026-119531","kind":"vulnerability","aliases":["CVE-2026-119531"],"related":[],"title":"Live Composer WordPress plugin: stored script runs in visitors' browsers","description":"The Live Composer  WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder shortcodes before outputting them inside HTML tag attributes, allowing users with the Contributor role and above to store a payload that executes in the browser of anyone who views the post, including an administrator reviewing the pending submission.","summary":"The Live Composer WordPress plugin before 2.1.24 fails to escape several shortcode attributes when it prints them into HTML. A user with Contributor access can store a payload that runs in the browser of anyone who views the post, including an administrator reviewing it.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["live-composer","package","self-hosted","wordpress"],"not_affected_if":["no-contributor-users","plugin-2.1.24-or-later","plugin-not-installed"],"how_to_check":"- Check the installed Live Composer plugin version in the WordPress admin under Plugins; a version below `2.1.24` is affected.\n- Look for Live Composer page-builder shortcodes in posts written by Contributor-level users.","fix":"- Live Composer plugin: move to `2.1.24` or later.","status":"open","published_at":"2026-11-11T06:17:16+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","triaged_at":"2026-11-11T06:27:34+00:00","updated_at":"2026-11-11T06:27:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:27:34Z","model":"claude-haiku-5-5","output":{"fix":"- Live Composer plugin: move to `2.1.24` or later.","reach":"internet","title":"Live Composer WordPress plugin: stored script runs in visitors' browsers","impact":"medium","summary":"The Live Composer WordPress plugin before 2.1.24 fails to escape several shortcode attributes when it prints them into HTML. A user with Contributor access can store a payload that runs in the browser of anyone who views the post, including an administrator reviewing it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","live-composer","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Script runs in an administrator's browser, enabling account takeover on the site","analyst_note":"unknown","how_to_check":"- Check the installed Live Composer plugin version in the WordPress admin under Plugins; a version below `2.1.24` is affected.\n- Look for Live Composer page-builder shortcodes in posts written by Contributor-level users.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-2.1.24-or-later","no-contributor-users"],"who_is_affected":"Sites running the Live Composer WordPress plugin before 2.1.24 that let Contributor-level users write posts. The flaw sits in page-builder shortcode output, so sites without Live Composer shortcodes or with only trusted authors are less exposed. Sites that do not run the plugin can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000736,"input_tokens":4554,"output_tokens":562,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119531':13A,16A '-2026':12A,15A '2.1.24':31B,74C 'access':48B 'administr':66B,120C 'allow':95C 'anyon':59B,113C 'attribut':37B,79C,94C 'browser':10A,57B,111C 'builder':86C 'compos':2A,19B,27B,70C 'contributor':47B,99C 'cve':11A,14A 'escap':34B,77C 'execut':108C 'fail':32B 'host':23B 'html':43B,92C 'includ':64B,118C 'insid':91C 'live':1A,18B,26B,69C 'live-compos':17B 'one':81C 'output':89C 'packag':20B 'page':85C 'page-build':84C 'payload':52B,106C 'pend':123C 'plugin':4A,29B,72C 'post':63B,117C 'print':40B 'review':67B,121C 'role':100C 'run':7A,54B 'script':6A 'self':22B 'self-host':21B 'sever':35B,78C 'shortcod':36B,87C 'store':5A,50B,104C 'submiss':124C 'tag':93C 'user':45B,96C 'view':61B,115C 'visitor':9A 'wordpress':3A,24B,28B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Live Composer WordPress plugin before 2.1.24 that let Contributor-level users write posts. The flaw sits in page-builder shortcode output, so sites without Live Composer shortcodes or with only trusted authors are less exposed. Sites that do not run the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["livecomposer","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119531':13A,16A '-2026':12A,15A 'browser':10A 'compos':2A 'cve':11A,14A 'live':1A 'plugin':4A 'run':7A 'script':6A 'store':5A 'visitor':9A 'wordpress':3A","search_b":"'2.1.24':31B 'access':48B 'administr':66B 'anyon':59B 'attribut':37B 'browser':57B 'compos':19B,27B 'contributor':47B 'escap':34B 'fail':32B 'host':23B 'html':43B 'includ':64B 'live':18B,26B 'live-compos':17B 'packag':20B 'payload':52B 'plugin':29B 'post':63B 'print':40B 'review':67B 'run':54B 'self':22B 'self-host':21B 'sever':35B 'shortcod':36B 'store':50B 'user':45B 'view':61B 'wordpress':24B,28B","search_c":"'2.1.24':74C 'administr':120C 'allow':95C 'anyon':113C 'attribut':79C,94C 'browser':111C 'builder':86C 'compos':70C 'contributor':99C 'escap':77C 'execut':108C 'html':92C 'includ':118C 'insid':91C 'live':69C 'one':81C 'output':89C 'page':85C 'page-build':84C 'payload':106C 'pend':123C 'plugin':72C 'post':117C 'review':121C 'role':100C 'sever':78C 'shortcod':87C 'store':104C 'submiss':124C 'tag':93C 'user':96C 'view':115C 'wordpress':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119531","severity":null,"published_at":"2026-11-11T06:17:16+00:00","modified_at":"2026-11-11T06:17:16+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","fetched_at":"2026-11-11T06:25:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}