What’s Vulnerable › Vulnerabilities

CVE-2021-25048: KingComposer <= 2.9.6 - Subscriber+ Stored Cross-Site Scripting

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-04 · updated 2026-06-17
• Weakness: CWE-79

Description

The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them

Affected products

• Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme: through 2.9.6

References

• https://wpscan.com/vulnerability/5687e5db-d987-416d-a7f4-036cce4d56cb
• https://wpscan.com/vulnerability/5687e5db-d987-416d-a7f4-036cce4d56cb

Get alerted when CVE-2021-25048 or the next vulnerability affects your stack