Skip to content
OpenAdvisories

Vendor

livecomposer

8 known vulnerabilities.

Products

Live Composer – Free WordPress Website Builder 8
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-16778

    Live Composer <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content

    The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and o…

    livecomposer Live Composer – Free WordPress Website Builder Web / CMS
  • Medium 6.4
    CVE-2026-16788

    Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode

    The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_projects_output Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escap…

    livecomposer Live Composer – Free WordPress Website Builder Web / CMS
  • Medium 6.4
    CVE-2026-16786

    Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode

    The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output e…

    livecomposer Live Composer – Free WordPress Website Builder Web / CMS
  • Medium 6.4
    CVE-2026-16787

    Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode

    The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. Thi…

    livecomposer Live Composer – Free WordPress Website Builder Web / CMS
  • Medium 6.4
    CVE-2026-13203

    Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute

    The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute of the dslc_modules_section and dslc_modules_area shortcodes in versions up to, and including, 2.1.19.…

    livecomposer Live Composer – Free WordPress Website Builder Web / CMS
  • Medium 6.4
    CVE-2025-13537

    Live Composer – Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

    The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to multiple Stored Cross-Site Scripting vulnerabilities via DOM manipulation in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output es…

    livecomposer Live Composer – Free WordPress Website Builder Web / CMS