CVE-2026-16786: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in livecomposer Live Composer – Free WordPress Website Builder

CVE-2026-16786 is a stored cross-site scripting vulnerability in the Live Composer – Free WordPress Website Builder plugin for WordPress. It affects all versions up to and including 2.1.19. The vulnerability is due to insufficient input sanitization and output escaping in the dslc_module_testimonials_output shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages via unescaped fields such as main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all. These scripts execute when the page is viewed because the shortcode processing function do_shortcode() renders the unescaped content at runtime. The injected payload bypasses the save-time wp_kses_post filtering because shortcode delimiters are treated as opaque, allowing malicious content to persist.

An attacker with contributor-level or higher privileges can inject malicious scripts that execute in the context of users viewing the affected pages. This can lead to information disclosure, session hijacking, or other client-side attacks. The vulnerability does not affect availability and requires authenticated access, but it impacts confidentiality and integrity of user interactions with the website.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the vulnerable shortcode. Monitor vendor channels for updates and apply official patches once released.