CVE-2026-16778 is a stored cross-site scripting vulnerability in the Live Composer – Free WordPress Website Builder plugin for WordPress. It affects all versions up to and including 2.1.21. The vulnerability is due to improper neutralization of input during web page generation, specifically in the 'dslc_module_downloads_output' shortcode content. Authenticated attackers with contributor-level privileges or higher can inject arbitrary web scripts. The issue stems from a bypass of the wp_kses_post sanitization because the payload is stored as a serialized string without HTML tags, which the filter does not tokenize. The shortcode callback then outputs attacker-controlled values such as view_all_link (href attribute), main_heading_title (h2 body), button_text (anchor body), and button_inline_svg (anchor body) without escaping, leading to script execution upon page rendering.

An attacker with contributor-level access or higher can inject malicious scripts into pages via the vulnerable shortcode. These scripts execute in the context of any user who views the injected page, potentially leading to session hijacking, privilege escalation, or other malicious actions. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable shortcode if possible. Avoid using the affected plugin versions in sensitive environments. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.