CVE-2025-13537: 
WordPress vulnerability analysis and mitigation

CVE-2025-13537 describes multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the Live Composer – Free WordPress Website Builder plugin for WordPress. All versions up to and including 2.0.2 are affected. The vulnerability was published on December 17, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is insufficient input sanitization and output escaping on user-supplied attributes processed via DOM manipulation in the plugin's frontend JavaScript (CWE-79: Improper Neutralization of Input During Web Page Generation). Specifically, vulnerable code paths exist in the plugin's frontend/index.js at lines 126 and 926, where user-controlled attribute values are written into the DOM without proper escaping. An authenticated attacker with at least Contributor-level access can craft page content containing malicious script payloads that are stored and later rendered in victims' browsers (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated contributor to inject persistent malicious JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors without requiring any user interaction. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or delivery of drive-by malware to site visitors. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the attacker's own session to affect all users viewing the compromised pages (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the publication date. The EPSS score is approximately 0.03%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Contributor-level privileges, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Live Composer – Free WordPress Website Builder plugin at version 2.0.2 or earlier using tools like WPScan or by inspecting plugin metadata in page source.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft Malicious Payload: Create or edit a page/post using the Live Composer builder and inject a malicious JavaScript payload into a user-supplied attribute field (e.g., a widget attribute or custom HTML field) that is processed by the vulnerable DOM manipulation code in frontend/index.js.
4. Store the Payload: Save or publish the page, causing the malicious script to be persisted in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the injected page, the stored XSS payload executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to page/post editing endpoints by low-privileged (Contributor) accounts, particularly with unusual attribute values containing <script>, javascript:, or encoded variants.
• File System: Unexpected modifications to pages or posts in the WordPress database containing obfuscated JavaScript or <script> tags within Live Composer widget attributes.
• Network: Outbound requests from victim browsers to unknown external domains (e.g., for cookie exfiltration or payload delivery) originating from pages built with Live Composer.
• Browser/Application: Unexpected JavaScript execution or redirects when visiting pages built with the Live Composer plugin, particularly on sites with Contributor-level user registration enabled.

A patch was committed to the plugin repository in changeset 3419715, which addresses the insufficient sanitization in the affected JavaScript files. Site administrators should update the Live Composer plugin to the version incorporating this fix as soon as it is available in the WordPress plugin repository. As an interim workaround, restrict Contributor-level user registration and audit existing Contributor accounts for unauthorized activity. Additionally, consider using a Web Application Firewall (WAF) with XSS filtering rules to reduce exposure (Wordfence, WordPress Trac).