Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

8 records

Vendor: livecomposer Clear all filters
TI-2026-13966 CVE-2026-16778 · GHSA-hv57-w5f4-r2xr

Cross-site scripting in livecomposer Live Composer – Free WordPress Website Builder

Priority LOW 29

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content in all versions up to, and including, 2.1.21 due t…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00383 Published 2026-09-22 No fix listed CWE-79
TI-2026-13973 CVE-2026-16788 · GHSA-mxp4-75jf-xp7h

Cross-site scripting in livecomposer Live Composer – Free WordPress Website Builder

Priority LOW 28

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_projects_output Shortcode in all versions up to, and including, 2.1.19 due to insuffici…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00349 Published 2026-09-01 No fix listed CWE-79
TI-2026-13971 CVE-2026-16786 · GHSA-vq42-9gx3-gj3v

Cross-site scripting in livecomposer Live Composer – Free WordPress Website Builder

Priority LOW 28

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode in all versions up to, and including, 2.1.19 due to insuf…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00349 Published 2026-09-01 No fix listed CWE-79
TI-2026-11211 CVE-2026-13203 · GHSA-q744-rpmq-q2gw

Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute

Priority LOW 29

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute of the dslc_modules_section and dslc_modules_area shortcodes in…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00419 Published 2026-09-01 No fix listed CWE-79
TI-2026-13972 CVE-2026-16787 · GHSA-vhjj-j285-vx8j

Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode

Priority LOW 28

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode in all versions up to, and including, 2.1.19 due to insufficient inpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00331 Published 2026-09-01 No fix listed CWE-79
TI-2025-12857 CVE-2025-14071 · GHSA-c838-8543-578v

Deserialization of untrusted data in livecomposer Live Composer – Free WordPress Website…

Priority LOW 36

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.2 via deserialization of untrusted input in the dslc_module_posts_ou…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00623 Published 2025-12-21 No fix listed CWE-502
TI-2025-12368 CVE-2025-13537 · GHSA-rwph-88j2-jxq8

Cross-site scripting in livecomposer Live Composer – Free WordPress Website Builder

Priority LOW 28

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to multiple Stored Cross-Site Scripting vulnerabilities via DOM manipulation in all versions up to, and including, 2.0.2 due to insuff…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0023 Published 2025-12-17 No fix listed CWE-79