CVE-2026-13203 Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customid' shortcode attribute of the dslcmodulessection and dslcmodulesarea shortcodes in versions up to, and including, 2.1.19. This is due to insufficient input...

CVE-2026-13203

CVE-2026-13203 is a Stored Cross-Site Scripting (XSS) vulnerability in the Live Composer – Free WordPress Website Builder plugin, affecting versions up to 2.1.19 . The root cause is insufficient sanitization and output escaping of the custom_id shortcode attribute in the dslc_modules_section and ...

WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'customid' Shortcode Attribute vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...