CVE-2026-2422: WP Composer Page Builder XSS Vulnerability

CVE-2026-2422 Overview

CVE-2026-2422 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Composer – The Easiest Page Builder plugin for WordPress. The flaw affects all versions up to and including 1.0.5. It resides in the pbwp_raw_shortcode shortcode handler, which decodes Base64-encoded content and outputs it directly without sanitization or escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes when any user views the injected page. The Base64 encoding bypasses WordPress's built-in KSES content filtering because the encoded string contains no HTML characters that would trigger sanitization at save time.

Critical Impact
Contributor-level users can persist arbitrary JavaScript that executes in the browsers of site visitors and administrators, enabling session theft, admin account takeover, and site defacement.

Affected Products

WP Composer – The Easiest Page Builder plugin for WordPress
All plugin versions through 1.0.5
WordPress sites permitting Contributor-level or higher registration

Discovery Timeline

2026-09-19 - CVE-2026-2422 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-2422

Vulnerability Analysis

The vulnerability is a Stored XSS issue classified under [CWE-79]. The pbwp_raw_shortcode shortcode handler, defined in inc/global/wpc-helpers.php, accepts user-supplied Base64 content and emits the decoded output directly into the page HTML. Because the handler applies no sanitization or output escaping, any HTML or JavaScript inside the decoded payload renders in the browser context of anyone viewing the affected post or page.

Stored XSS in a page builder shortcode is particularly effective because injected payloads execute in the sessions of authenticated administrators who preview or edit the content. Attackers can leverage this to exfiltrate session cookies, hijack accounts, insert backdoor administrator users, or pivot to full site compromise.

Root Cause

The root cause is missing output encoding combined with a design pattern that intentionally decodes attacker-controllable Base64 input at render time. WordPress applies KSES filtering when content is saved through wp_kses_post(), stripping dangerous tags such as <script>. Because the malicious payload is stored as an opaque Base64 string, KSES sees only alphanumeric characters and preserves the content. The dangerous HTML materializes only at shortcode expansion, after all input filtering has completed.

Attack Vector

Exploitation requires an authenticated account with Contributor privileges or higher. The attacker Base64-encodes a JavaScript payload, wraps it inside the pbwp_raw_shortcode shortcode, and saves the content in a post. When any visitor or administrator loads the rendered page, the shortcode handler decodes the payload and injects it into the DOM, triggering script execution in the victim's browser session under the site's origin.

For technical details, see the WordPress Plugin Code Reference and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-2422

Indicators of Compromise

Posts or pages containing the [pbwp_raw_shortcode] shortcode with Base64-encoded attribute values authored by Contributor or Author accounts.
Unexpected <script> tags, event handlers, or external script src references appearing in rendered page output.
Newly created administrator accounts or role changes following Contributor activity.
Outbound requests from visitor browsers to unfamiliar domains after loading affected pages.

Detection Strategies

Query the wp_posts table for post_content containing pbwp_raw_shortcode and decode any embedded Base64 strings for review.
Compare rendered page HTML against post source to identify script content that was not present at save time.
Monitor WordPress audit logs for content edits by low-privilege users that introduce this shortcode.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script violations originating from plugin-rendered pages.
Alert on creation of administrative users or capability changes occurring shortly after Contributor post edits.
Log and review all shortcode registrations and attribute values in production WordPress deployments.

How to Mitigate CVE-2026-2422

Immediate Actions Required

Update the WP Composer plugin to a version newer than 1.0.5 once a patched release is available from the vendor.
Audit all existing posts and pages for the pbwp_raw_shortcode shortcode and remove any instances containing untrusted Base64 payloads.
Review and downgrade unnecessary Contributor and Author accounts, and reset credentials for suspected accounts.
Rotate WordPress secret keys and force re-authentication for all administrator sessions.

Patch Information

A vendor changeset is referenced in the WordPress Changeset Details. Administrators should upgrade to the fixed release identified in that changeset and confirm the pbwp_raw_shortcode handler applies proper output escaping.

Workarounds

Deactivate the WP Composer plugin until a fixed version is installed.
Restrict registration and remove Contributor-level accounts from untrusted users.
Deploy a Web Application Firewall (WAF) rule to block requests containing the pbwp_raw_shortcode shortcode from non-administrative users.
Enforce a strict Content Security Policy that disallows inline scripts on public-facing WordPress pages.

bash

# Locate posts containing the vulnerable shortcode
wp db query "SELECT ID, post_title, post_author FROM wp_posts WHERE post_content LIKE '%pbwp_raw_shortcode%';"

# Deactivate the plugin as an interim mitigation
wp plugin deactivate page-builder-wp