A stored cross‑site scripting flaw arises from improper neutralization of input during web page generation in the Live Composer Page Builder plugin. An attacker can place malicious scripts into content that is then rendered and served in the browsers of any visitor to the affected pages. Because the injected code remains in the stored content, it can execute repeatedly for all users who view the compromised page.

The Live Composer Page Builder plugin, including all releases from its introduction up to and including version 2.1.13, is affected. The vulnerability covers any instance of the plugin on a WordPress site that has a version less than or equal to 2.1.13.

The CVSS score of 6.5 indicates a moderate severity for this stored XSS weakness. The EPSS score of less than 1% suggests a very low probability of active exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to identify or create a content entry point within the plugin—such as a form or editor field—to inject malicious code; once stored, the script would be delivered to visitors who load the affected pages.