CVE-2026-2422 in WP Composer Plugin
Summary
by MITRE • 09/19/2026
The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwp_raw_shortcode' shortcode in all versions up to, and including, 1.0.5. This is due to the shortcode handler decoding Base64-encoded content and outputting it directly without any sanitization or escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The Base64 encoding allows the payload to bypass WordPress's KSES content filtering at save time, since the encoded string contains no harmful HTML characters.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified within the WP Composer – The Easiest Page Builder plugin for WordPress represents a significant security risk due to its potential for Stored Cross-Site Scripting attacks. This flaw exists in all versions of the plugin up through and including version 1.0.5, affecting any site that utilizes this specific page building tool. The core issue lies within the handling of the pbwp_raw_shortcode shortcode, which is designed to allow users to insert raw content into their pages. However, the implementation fails to properly sanitize or escape user-supplied data before rendering it in a web browser context. This lack of proper output encoding creates an avenue for attackers to inject malicious client-side scripts that will execute when other users view the compromised page.
From a technical perspective, the vulnerability stems from the shortcode handler's logic which decodes Base64-encoded content and outputs it directly without applying necessary security checks. Typically, WordPress employs KSES, a library designed to strip out potentially dangerous HTML tags such as script elements, to protect against XSS attacks during content saving. However, because the attacker encodes their malicious payload in Base64 format before submission, the string does not contain any recognizable harmful HTML characters at the time of storage. Consequently, the KSES filter passes the data through without modification. When the page is subsequently rendered and the shortcode is processed, the system decodes the Base64 string back into its original form, which includes executable JavaScript code, thereby bypassing the initial content filtering mechanisms entirely.
The operational impact of this vulnerability is severe because it allows for persistent attacks rather than transient ones. Since the malicious script is stored within a page or post on the WordPress site, every user who visits that specific page will have their browser execute the injected code. This can lead to various adverse outcomes including session hijacking, where an attacker steals authentication cookies to impersonate legitimate users; defacement of the website by altering its visual presentation; or redirection of visitors to malicious external sites designed for phishing or malware distribution. The requirement for authenticated access with Contributor-level privileges and above means that while a low-privilege user cannot exploit this directly, any editor, author, contributor, administrator, or subscriber who has been granted permission to create content can become an unwitting vector for the attack if their account is compromised.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under the subcategory of Stored XSS where malicious scripts are permanently stored within target applications such as databases or content management systems. In terms of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to techniques involving Client-side Injection and potentially T1059 Command and Control if used in conjunction with other malware delivery methods. The use of Base64 encoding serves as an Obfuscated Files or Information technique (T1027), allowing attackers to evade signature-based detection systems that might otherwise flag obvious script tags during the upload process.
Mitigation strategies for this vulnerability involve immediate action by site administrators and developers responsible for maintaining WordPress installations using WP Composer. The most effective remediation is to upgrade the plugin to a version later than 1.0.5, where the developer has presumably implemented proper input validation and output escaping mechanisms. If upgrading is not immediately feasible, temporary mitigations include restricting access to the pbwp_raw_shortcode functionality by disabling it if possible through configuration settings or removing the shortcode from allowed lists in themes that support customizing permitted shortcodes. Additionally, implementing a Web Application Firewall can help detect and block attempts to inject Base64-encoded script payloads into content fields, although this is less reliable than patching the underlying code flaw. Regular security audits and monitoring of user-generated content for anomalous patterns can also aid in early detection of exploitation attempts before significant damage occurs.