Plugin icon

Live Composer – Free WordPress Website Builder

live-composer-page-builder

Vulnerabilities:

11

Last Updated:

April 1, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2025-12-22
Title
Page Builder: Live Composer <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
No known fix
CVSS
6.4 (medium)
Published
2025-12-20
Title
Live Composer – Free WordPress Website Builder < 2.0.3 - Authenticated (Contributor+) PHP Object Injection via dslc_module_posts_output Shortcode
Fixed in
Fixed in 2.0.3
CVSS
7.5 (high)
Published
2025-12-16
Title
Live Composer – Free WordPress Website Builder < 2.0.3 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Fixed in
Fixed in 2.0.3
CVSS
6.4 (medium)
Published
2024-06-19
Title
Page Builder: Live Composer < 1.5.43 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 1.5.43
CVSS
7.5 (high)
Published
2024-06-19
Title
Page Builder: Live Composer < 1.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.5.43
CVSS
6.4 (medium)
Published
2024-06-18
Title
Page Builder: Live Composer <= 2.1.6 - Author+ Stored XSS
Fixed in
No known fix
CVSS
4.8 (medium)
Published
2024-04-23
Title
Page Builder: Live Composer < 1.5.39 - Missing Authorization
Fixed in
Fixed in 1.5.39
CVSS
4.3 (medium)
Published
2024-04-10
Title
Page Builder: Live Composer < 1.5.36 - Cross-Site Request Forgery
Fixed in
Fixed in 1.5.36
CVSS
4.3 (medium)
Published
2024-01-03
Title
Page Builder: Live Composer < 1.5.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.5.24
CVSS
6.4 (medium)
Published
2024-01-03
Title
Page Builder: Live Composer < 1.5.29 - Author+ PHP Object Injection
Fixed in
Fixed in 1.5.29
CVSS
6.6 (medium)
Published
2023-01-24
Title
Page Builder: Live Composer < 1.5.23 - Contributor+ Stored XSS via Shortcode
Fixed in
Fixed in 1.5.23
CVSS
6.8 (medium)