Stored Cross-Site Scripting Vulnerability in WP Composer Page Builder Plugin for WordPress

CVE-2026-2422

What is CVE-2026-2422?

The WP Composer – The Easiest Page Builder plugin for WordPress is susceptible to a Stored Cross-Site Scripting flaw. This vulnerability arises from the 'pbwp_raw_shortcode' shortcode processing Base64-encoded content without appropriate sanitization. Consequently, authenticated users with Contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute when other users access the affected pages, effectively bypassing WordPress's standard content filtering mechanisms due to the nature of the Base64 encoding. Site administrators are urged to update to the latest version to mitigate this risk.

References