CVE-2026-2422 is a stored Cross-Site Scripting vulnerability in the WP Composer – The Easiest Page Builder plugin for WordPress, affecting all versions up to and including 1.0.5. The vulnerability exists because the 'pbwp_raw_shortcode' shortcode handler decodes Base64-encoded input and outputs it directly without sanitization or escaping. This allows authenticated users with Contributor or higher privileges to inject arbitrary JavaScript code that executes in the context of any user visiting the injected page. The use of Base64 encoding circumvents WordPress's KSES content filtering at save time, enabling the malicious payload to be stored and later executed.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of any users who view the compromised pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions and data.

No official patch or fix is currently available for this vulnerability. Users should restrict Contributor-level access to trusted users only and consider disabling or removing the WP Composer plugin until a fix is released. Monitor the vendor's advisory channels for updates. Since the vulnerability relies on the shortcode handler's unsafe output of decoded Base64 content, avoid using the 'pbwp_raw_shortcode' shortcode if possible.