CVE-2026-13203: Live Composer WordPress Plugin XSS Vulnerability

CVE-2026-13203 Overview

The Live Composer – Free WordPress Website Builder plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 2.1.19. The flaw resides in the custom_id shortcode attribute of the dslc_modules_section and dslc_modules_area shortcodes. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes when other users view the affected page. The vulnerability is tracked as [CWE-79] and stems from insufficient input sanitization and output escaping in the plugin's rendering functions.

Critical Impact
Authenticated attackers with Contributor privileges can inject persistent JavaScript payloads that execute in the browser context of any visitor, including administrators, enabling session hijacking and privileged action abuse.

Affected Products

Live Composer – Free WordPress Website Builder plugin, versions up to and including 2.1.19
WordPress installations exposing Contributor-level (or higher) registration
Sites using the dslc_modules_section or dslc_modules_area shortcodes

Discovery Timeline

2026-09-01 - CVE-2026-13203 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-13203

Vulnerability Analysis

The Live Composer page builder plugin exposes two shortcodes, dslc_modules_section and dslc_modules_area, that accept a user-supplied custom_id attribute. This attribute is concatenated directly into the HTML id="" attribute of a rendered <div> element. Because the value is never passed through WordPress's esc_attr() output-escaping helper, an attacker can break out of the attribute context and inject arbitrary HTML or JavaScript. The payload is stored in the post content and executes whenever a user renders the page in a browser.

Contributor accounts on WordPress can create draft posts but require an editor or administrator to publish them. This constraint reduces the attack surface but does not eliminate risk, because the payload triggers when a reviewer previews the draft.

Root Cause

The root cause is missing output escaping in the dslc_modules_section_front() and dslc_modules_area_front() functions inside includes/display-functions.php. The vulnerable code paths appear at multiple lines in the plugin source, including lines 1882, 1888, 1922, 2107, and 2113 of the referenced release branches. See the WordPress plugin repository for the vulnerable code. The user-controlled custom_id value is inserted directly into HTML without calling esc_attr(), violating the WordPress output-escaping guidelines.

Attack Vector

An attacker authenticates to the WordPress site with at least Contributor privileges. They create or edit a post containing the dslc_modules_section or dslc_modules_area shortcode and supply a crafted custom_id attribute that closes the enclosing id attribute and injects an event handler such as onmouseover or a <script> tag. When any user, including an administrator previewing or reviewing the post, loads the page, the injected script executes with the victim's session context.

Because the CVSS scope is Changed, exploitation can affect resources beyond the vulnerable component, such as the WordPress admin session.

Detection Methods for CVE-2026-13203

Indicators of Compromise

Post content containing dslc_modules_section or dslc_modules_area shortcodes with unusual custom_id values containing quotes, angle brackets, or JavaScript keywords
Unexpected <script> tags or event handler attributes (onerror, onload, onmouseover) rendered inside <div> elements produced by Live Composer
New or modified posts authored by low-privilege Contributor accounts referencing Live Composer shortcodes

Detection Strategies

Query the wp_posts table for shortcode attributes containing characters such as ", <, >, or the substring on followed by an equals sign inside custom_id values
Inspect rendered HTML output on public pages for malformed id attributes or script content nested inside builder-generated <div> elements
Correlate content-management audit logs with unusual editing activity from Contributor-tier accounts

Monitoring Recommendations

Enable WordPress audit logging for post creation, revision, and shortcode changes performed by non-administrative users
Monitor outbound requests from admin browsers that could indicate cookie exfiltration or credential theft triggered by stored payloads
Alert on file modifications to includes/display-functions.php within the live-composer-page-builder plugin directory

How to Mitigate CVE-2026-13203

Immediate Actions Required

Update the Live Composer plugin to a version newer than 2.1.19 as soon as a patched release is available from the vendor
Audit all existing posts and drafts that use dslc_modules_section or dslc_modules_area shortcodes and remove any suspicious custom_id values
Review Contributor, Author, and Editor accounts for unauthorized or dormant users and reset credentials where appropriate

Patch Information

The vendor addressed the issue in the plugin repository. Refer to the WordPress plugin changeset for the code changes and the Wordfence vulnerability report for advisory details.

Workarounds

Restrict Contributor-level and higher account creation, and disable public registration where feasible
Deploy a web application firewall rule that blocks shortcode input containing quotes or angle brackets inside custom_id attributes
Temporarily deactivate the Live Composer plugin on sites where patching is not immediately possible
Require administrator approval and manual review of draft content before preview or publication

bash

# Configuration example: WP-CLI commands to identify affected content
wp post list --post_type=any --format=ids | xargs -I {} wp post get {} --field=post_content \
  | grep -E 'dslc_modules_(section|area)[^]]*custom_id="[^"]*[<>"][^"]*"'

# Disable the plugin until a patched version is installed
wp plugin deactivate live-composer-page-builder