Description
The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder shortcodes before outputting them inside HTML tag attributes, allowing users with the Contributor role and above to store a payload that executes in the browser of anyone who views the post, including an administrator reviewing the pending submission.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Live Composer | < 2.1.24 | 2.1.24 |
References
- https://wpscan.com/vulnerability/493ae475-0595-4421-812e-304315457329/ exploit vdb-entry technical-description