WordPress Live Composer – Free WordPress Website Builder plugin <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Page Builder: Live Composer versions = 2.1.21...

CVE-2025-68598: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 2.1.22...

EUVD-2024-35538

Malicious code in bioql PyPI...

CVE-2024-35768

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Live Composer Team Page Builder: Live Composer allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 1.5.42...

PT-2024-26735

Name of the Vulnerable Software and Affected Versions Page Builder: Live Composer versions 1.5.42 and earlier Description The issue is related to Deserialization of Untrusted Data, which affects Page Builder: Live Composer. Recommendations For versions 1.5.42 and earlier, update to a version late...

CVE-2022-4669: Improper Neutralization of Input During Web Page Generation

The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

PT-2023-14991

Name of the Vulnerable Software and Affected Versions The Page Builder: Live Composer WordPress plugin versions prior to 1.5.23 Description The issue concerns the lack of validation and escaping of certain shortcode attributes in the plugin, which could allow users with the contributor role and...

Page Builder: Live Composer < 1.5.23 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. dslcnotification color='red"...