Code Injection Vulnerability in Live Composer WordPress Plugin
CVE-2026-119531

Currently unrated

Key Information:

Vendor

WordPress
Status
Live Composer
Vendor
CVE Published:
11 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-119531?

The Live Composer plugin for WordPress versions prior to 2.1.24 is susceptible to a code injection vulnerability. This occurs due to the plugin failing to properly escape several attributes of its page-builder shortcodes before rendering them inside HTML tag attributes. As a result, any user with Contributor access or higher can store a potentially malicious payload, which, when viewed by any user, including administrators, will execute in the browser. This breach can lead to unauthorized actions and compromise the integrity of the affected website.

Affected Version(s)

Live Composer 0 < 2.1.24

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-119531 - Proof of Concept

References

https://wpscan.com/vulnerability/493ae475-0595-4421-812e-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Enrico Marcolini
Claudio Marchesini
Dottor Marc
WPScan
.