A Stored Cross-Site Scripting vulnerability in the Live Composer WordPress plugin allows authenticated contributors to inject malicious scripts, posing a risk of unauthorized session or data access.

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw triggered via the dslc_module_downloads_output shortcode. It allows authenticated attackers with contributor-level access or higher to bypass sanitization filters and inject arbitrary web scripts that execute in the context of a user viewing the affected page.

Successful exploitation allows an attacker to execute malicious JavaScript in the browsers of users who visit compromised pages. This could lead to session hijacking, unauthorized actions performed on behalf of administrators, or the redirection of users to malicious sites, potentially resulting in significant reputational damage and the compromise of sensitive site data. The CVSS score of 6.4 reflects a moderate severity, primarily due to the requirement for authenticated access, though the impact is amplified by the potential for cross-site script execution.

Immediate Action: Update the Live Composer – Free WordPress Website Builder plugin to the latest available version provided by the vendor to resolve the sanitization bypass.

Proactive Monitoring: Review web application access logs for suspicious activity originating from contributor-level accounts, specifically monitoring for unusual strings or script tags within shortcode parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS patterns and malicious script injection attempts in incoming HTTP requests.

Public Exploit Available: Unknown

Organizations utilizing the Live Composer plugin should prioritize updating to the patched version immediately to eliminate the risk of script injection. Because this vulnerability targets the contributor role, administrators should also audit current user permissions to ensure that only trusted individuals hold contributor-level access or higher on the platform.