CVE-2024-35768 in Page Builder Plugin
Summary
by MITRE • 06/21/2024
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiveComposer Page Builder: Live Composer live-composer-page-builder allows DOM-Based XSS.This issue affects Page Builder: Live Composer: from n/a through <= 2.1.11.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/02/2026
The vulnerability identified as CVE-2024-35768 represents a critical cross-site scripting flaw within the LiveComposer Page Builder plugin, specifically manifesting as a DOM-based XSS vulnerability. This weakness resides in the web page generation process where input validation and sanitization mechanisms fail to properly neutralize malicious content before it is rendered in the browser environment. The vulnerability is particularly concerning as it enables attackers to inject malicious scripts that execute within the context of legitimate user sessions, potentially compromising user data and browser integrity.
The technical flaw stems from improper handling of user-provided input parameters within the DOM manipulation functions of the Live Composer plugin. When users interact with the page builder interface or when content is dynamically generated through the plugin's functionality, the system fails to adequately sanitize or escape input data that gets processed and subsequently rendered in the browser. This creates an environment where malicious scripts can be injected through parameters that are directly manipulated within the document object model. The vulnerability specifically affects versions of the plugin from the initial release through version 2.1.11, indicating a prolonged period during which this security gap existed.
The operational impact of this vulnerability extends beyond simple script execution as it enables attackers to perform a range of malicious activities including session hijacking, credential theft, data exfiltration, and redirection to malicious sites. Since the vulnerability is DOM-based, it operates entirely within the browser environment without requiring server-side processing, making it particularly difficult to detect through traditional network monitoring. Attackers can exploit this vulnerability by crafting malicious URLs that contain XSS payloads, which when clicked by authenticated users with appropriate privileges, execute scripts in the context of the victim's browser session. This allows for complete compromise of user sessions and potential privilege escalation within the WordPress environment.
Mitigation strategies for CVE-2024-35768 should prioritize immediate plugin updates to versions that address the XSS vulnerability, as this represents the most effective defense mechanism. Organizations should implement comprehensive input validation and output encoding mechanisms across all user-facing interfaces, particularly focusing on DOM manipulation functions that handle dynamic content generation. The implementation of Content Security Policy headers can provide additional protection layers by restricting script execution sources and preventing unauthorized code injection. Regular security audits and penetration testing of web applications should include thorough examination of DOM-based vulnerabilities, with particular attention to how dynamic content is handled within page builder and content management systems. This vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and maps to ATT&CK technique T1059.007 for script injection attacks, highlighting the need for comprehensive defensive measures that address both input sanitization and runtime protection mechanisms.