The Live Composer – Free WordPress Website Builder plugin contains a CWE‑79 Stored Cross‑Site Scripting flaw that allows an authenticated content contributor or higher role to inject arbitrary JavaScript through the 'dslc_module_downloads_output' shortcode. The plugin’s sanitized input checks are bypassed because the payload is stored as a serialized string lacking HTML tags for wp_kses_post to process; when the shortcode is rendered, vulnerable fields such as view_all_link, main_heading_title, button_text, and button_inline_svg are output without escaping. This flaw permits attackers to execute scripts in the browsers of any visitor who views the affected page, thereby enabling session hijacking, data theft, defacement, or delivery of malware. The attack does not require remote code execution on the server side, but it provides a powerful client‑side vector for further attack stages.

Any WordPress site running Live Composer – Free WordPress Website Builder version 2.1.21 or earlier is impacted. The plugin is the sole affected component; all websites that incorporate this plugin into their pages or posts are vulnerable. No specific WordPress core versions are listed, so the flaw applies across all supported WordPress installations that include the vulnerable plugin.

The CVSS base score of 6.4 indicates a moderate severity. Attackers must be authenticated contributors or higher to exploit the vulnerability, but once they have payload discretion, the stored XSS can affect all visitors to the page, including site administrators. The EPSS score is not provided, and the flaw is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. However, the stored nature of the payload makes it persistent and advantageous for an attacker, so the risk of exploitation remains significant if the plugin is left unpatched.