CMSMasters Content Composer

CMSMasters Content Composer has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 4 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 2 high. 2025 was the busiest year with 2 disclosures.

The most common weakness is PHP Remote File Inclusion, behind 2 of the records (50%). Other recurring categories include Cross-Site Scripting, Missing Authorization.

Every one of the 4 issues recorded for CMSMasters Content Composer has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each.

01234567891008.10.2024Today08.10.20246.4CMSMasters Content Composer <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 08.10.202401.07.20258.1CMSMasters Content Composer < 2.5.7 - Unauthenticated Local File Inclusion CVSS 8.1 · 01.07.202514.12.20254.3CMSMasters Content Composer <= 2.5.8 - Missing Authorization CVSS 4.3 · 14.12.202502.02.20267.5CMSMasters Content Composer <= 1.4.5 - Authenticated (Contributor+) Local File Inclusion CVSS 7.5 · 02.02.2026

Strategic Overview

Avg CVSSMedium
6.6/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all CMSMasters Content Composer vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2025-4414

CMSMasters Content Composer < 2.5.7 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

4 records
Showing 1–4 of 4 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C