Plugin icon

Live Composer – Free WordPress Website Builder

live-composer-page-builder

Vulnerabilities:

17

Last Updated:

September 21, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-09-21
Title
Live Composer < 2.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content
Fixed in
Fixed in 2.1.22
CVSS
5.5 (medium)
Published
2026-09-07
Title
Live Composer < 2.1.19 - Authenticated (Contributor+) PHP Object Injection via Shortcode
Fixed in
Fixed in 2.1.19
CVSS
7.2 (high)
Published
2026-08-31
Title
Live Composer < 2.1.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode
Fixed in
Fixed in 2.1.20
CVSS
5.5 (medium)
Published
2026-08-31
Title
Live Composer < 2.1.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode
Fixed in
Fixed in 2.1.20
CVSS
5.5 (medium)
Published
2026-08-31
Title
Live Composer < 2.1.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode
Fixed in
Fixed in 2.1.20
CVSS
5.5 (medium)
Published
2026-08-31
Title
Live Composer < 2.1.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute
Fixed in
Fixed in 2.1.20
CVSS
5.5 (medium)
Published
2025-12-22
Title
Page Builder: Live Composer <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
No known fix
CVSS
5.5 (medium)
Published
2025-12-20
Title
Live Composer – Free WordPress Website Builder < 2.0.3 - Authenticated (Contributor+) PHP Object Injection via dslc_module_posts_output Shortcode
Fixed in
Fixed in 2.0.3
CVSS
7.5 (high)
Published
2025-12-16
Title
Live Composer – Free WordPress Website Builder < 2.0.3 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Fixed in
Fixed in 2.0.3
CVSS
6.4 (medium)
Published
2024-06-19
Title
Page Builder: Live Composer < 1.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.5.43
CVSS
6.4 (medium)
Published
2024-06-19
Title
Page Builder: Live Composer < 1.5.43 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 1.5.43
CVSS
7.5 (high)
Published
2024-06-18
Title
Page Builder: Live Composer <= 2.1.22 - Author+ Stored XSS
Fixed in
No known fix
CVSS
4.8 (medium)
Published
2024-04-23
Title
Page Builder: Live Composer < 1.5.39 - Missing Authorization
Fixed in
Fixed in 1.5.39
CVSS
4.3 (medium)
Published
2024-04-10
Title
Page Builder: Live Composer < 1.5.36 - Cross-Site Request Forgery
Fixed in
Fixed in 1.5.36
CVSS
4.3 (medium)
Published
2024-01-03
Title
Page Builder: Live Composer < 1.5.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.5.24
CVSS
6.4 (medium)
Published
2024-01-03
Title
Page Builder: Live Composer < 1.5.29 - Author+ PHP Object Injection
Fixed in
Fixed in 1.5.29
CVSS
6.6 (medium)
Published
2023-01-24
Title
Page Builder: Live Composer < 1.5.23 - Contributor+ Stored XSS via Shortcode
Fixed in
Fixed in 1.5.23
CVSS
6.8 (medium)