CVE-2026-13203

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute of the dslc_modules_section and dslc_modules_area shortcodes in versions up to, and including, 2.1.19. This is due to insufficient input sanitization and output escaping on the user-supplied attribute, which is concatenated into the HTML id="" attribute of the rendered <div> element in the dslc_modules_section_front() and dslc_modules_area_front() functions without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.13/includes/display-functions.php#L1882
• https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.13/includes/display-functions.php#L1888
• https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.13/includes/display-functions.php#L1922
• https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.13/includes/display-functions.php#L2107
• https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.13/includes/display-functions.php#L2113
• https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.17/includes/display-functions.php#L1882
• https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.17/includes/display-functions.php#L1888
• https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.17/includes/display-functions.php#L1922
• https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.17/includes/display-functions.php#L2107
• https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.17/includes/display-functions.php#L2113
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3662813%40live-composer-page-builder&new=3662813%40live-composer-page-builder
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9b9e0302-b981-4885-822f-063247bec4b2?source=cve

Published

Sep 1, 2026

Last Modified

Sep 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13198Nozomi Networks Labs identified a CWE-362: Concurrent Execut…5.9
• CVE-2026-13199EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devic…5.1
• CVE-2026-1320The Secure Copy Content Protection and Content Locking plugi…7.2
• CVE-2026-13200The Create plugin for WordPress is vulnerable to generic SQL…6.5
• CVE-2026-13201A flaw was found in KubeVirt's safepath package used by virt…7.3
• CVE-2026-13202A vulnerability in OpenText Opentext Directory Services allo…7.3
• CVE-2026-13204If a provably insecure domain is covered by both an NSEC and…7.5
• CVE-2026-13206Improper neutralization of special elements used in an OS co…9.8
• CVE-2026-13207FUXA versions 1.3.1 and prior contain an authentication bypa…8.7
• CVE-2026-13208A flaw was found in KubeVirt's virt-handler domain notify se…6.5
• CVE-2026-1321The Membership Plugin – Restrict Content plugin for WordPres…8.1
• CVE-2026-13210GitLab has remediated an issue in GitLab CE/EE affecting all…7.7