{"id":"CVE-2026-119073","published":"2026-11-07T06:16:57.933","lastModified":"2026-11-10T16:28:46.510","description":"The Live Composer  WordPress plugin before 2.1.23 does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.","cvssScore":6.8,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/67f28843-96a1-4318-8601-21c90bd5b10e/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}