CVE-2026-16788: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in livecomposer Live Composer – Free WordPress Website Builder

CVE-2026-16788 is a stored cross-site scripting vulnerability in the Live Composer – Free WordPress Website Builder plugin for WordPress. The flaw exists in the dslc_module_projects_output shortcode, where parameters such as view_all_link, main_heading_link_title, main_filter_title_all, and button_text are not properly sanitized or escaped. This allows authenticated users with contributor-level or higher privileges to inject malicious scripts that execute when the injected page is accessed. The issue is due to WordPress's shortcode-aware kses handling preserving the serialized shortcode body as a placeholder before content filtering, enabling attacker-controlled input to reach render-time sinks without escaping. All versions up to and including 2.1.19 are affected.

An attacker with contributor-level access or higher can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of users viewing the affected pages. This can lead to session hijacking, defacement, or other malicious actions within the scope of the affected site. The vulnerability does not affect unauthenticated users directly but leverages authenticated user privileges to inject the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling the vulnerable shortcode if possible. Monitor for updates from the Live Composer plugin vendor regarding an official fix.