Read the docs

livecomposer

Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

livecomposer records in CISA KEV

No livecomposer vulnerabilities are listed in CISA KEV.

Records

8 records

TI-2025-12857 CVE-2025-14071 · GHSA-c838-8543-578v

Deserialization of untrusted data in livecomposer Live Composer – Free WordPress Website…

Priority LOW 36

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.2 via deserialization of untrusted input in the dslc_module_posts_ou…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00623 Published 2025-12-21 No fix listed CWE-502
TI-2026-13966 CVE-2026-16778 · GHSA-hv57-w5f4-r2xr

Cross-site scripting in livecomposer Live Composer – Free WordPress Website Builder

Priority LOW 29

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content in all versions up to, and including, 2.1.21 due t…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00383 Published 2026-09-22 No fix listed CWE-79
TI-2026-11211 CVE-2026-13203 · GHSA-q744-rpmq-q2gw

Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute

Priority LOW 29

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute of the dslc_modules_section and dslc_modules_area shortcodes in…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00419 Published 2026-09-01 No fix listed CWE-79
TI-2026-13973 CVE-2026-16788 · GHSA-mxp4-75jf-xp7h

Cross-site scripting in livecomposer Live Composer – Free WordPress Website Builder

Priority LOW 28

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_projects_output Shortcode in all versions up to, and including, 2.1.19 due to insuffici…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00349 Published 2026-09-01 No fix listed CWE-79
TI-2026-13972 CVE-2026-16787 · GHSA-vhjj-j285-vx8j

Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode

Priority LOW 28

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode in all versions up to, and including, 2.1.19 due to insufficient inpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00331 Published 2026-09-01 No fix listed CWE-79
TI-2026-13971 CVE-2026-16786 · GHSA-vq42-9gx3-gj3v

Cross-site scripting in livecomposer Live Composer – Free WordPress Website Builder

Priority LOW 28

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode in all versions up to, and including, 2.1.19 due to insuf…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00349 Published 2026-09-01 No fix listed CWE-79
TI-2025-12368 CVE-2025-13537 · GHSA-rwph-88j2-jxq8

Cross-site scripting in livecomposer Live Composer – Free WordPress Website Builder

Priority LOW 28

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to multiple Stored Cross-Site Scripting vulnerabilities via DOM manipulation in all versions up to, and including, 2.0.2 due to insuff…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0023 Published 2025-12-17 No fix listed CWE-79
Open these records in search →