The vulnerability arises from the Live Composer WordPress plugin not sanitizing or escaping custom post type slug values before placing them in front‑end URLs. When a high‑privilege user, such as an administrator, creates or edits a partner slug containing malicious JavaScript, that code is stored in the database. Subsequent visitors who view the affected link are forced to load the malicious script, giving the attacker the ability to execute arbitrary JavaScript in the context of the site, steal authentication cookies, or deface content. This is a classic Stored Cross‑Site Scripting flaw.

The affected product is the Live Composer plugin for WordPress versions older than 2.1.23. No other vendors or product families are listed; the CNA identifies the vendor as Unknown:Live Composer. Because the plugin uses custom post type slugs that are rendered on the public site, any WordPress installation using the vulnerable plugin version is at risk. The exact list of susceptible versions is limited to those preceding the 2.1.23 release, as this is the cutoff for the patch.

The exploit does not require open network access; an attacker needs the ability to log into the site as a user with the capability to edit partner slugs, typically an administrator or editor. The flaw does not rely on the unfiltered_html capability, meaning even sites that have removed that capability remain vulnerable. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, but stored XSS of this nature can cause significant compromise of user sessions and site integrity. The CVSS score is not provided in the data, so the overall severity must be inferred from the impact on confidentiality, integrity, and availability, with a high potential for privilege escalation and defacement.