CVE-2026-16787: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in livecomposer Live Composer – Free WordPress Website Builder

CVE-2026-16787 describes a stored cross-site scripting vulnerability in the Live Composer – Free WordPress Website Builder plugin for WordPress. The vulnerability exists in the handling of the 'dslc_custom_field' shortcode, where input is not properly sanitized or escaped before being stored and rendered. Authenticated attackers with contributor-level privileges or above can exploit this to inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. This can lead to information disclosure or session hijacking. The vulnerability affects all versions up to and including 2.1.19. No official patch or remediation guidance has been provided at this time.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who visit those pages. This can result in limited confidentiality and integrity impacts, such as theft of user credentials or session tokens. There is no direct impact on availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and partial confidentiality and integrity impact with scope changed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the 'dslc_custom_field' shortcode if possible to reduce risk.