CVE-2026-16778
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Live Composer plugin for WordPress in versions up to and including 2.1.21 is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages that execute when a user visits the injected page.
Risk Assessment
An attacker can execute arbitrary scripts in users' browsers, potentially leading to session theft, redirects, or other attacks.
Recommendation
Update the Live Composer plugin to a version newer than 2.1.21 as soon as it becomes available.
Other vulnerabilities in Live Composer
See all- CVE-2026-16502High
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input. This makes it possible for authenticated attackers with contributor-level access and above to inject a PHP Object. No known POP chain is present in the vulnerable software, meaning no impact unless another plugin or theme with a POP chain is installed. If a POP chain is present, it may allow actions like deleting arbitrary files, retrieving sensitive data, or executing code.
- CVE-2026-16788Medium
The Live Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_projects_output Shortcode in all versions up to and including 2.1.19 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that execute whenever a user accesses the page.
- CVE-2026-16786Medium
The Live Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode in all versions up to and including 2.1.19 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that execute whenever a user accesses the page.
Original NVD description (English source)
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time wp_kses_post check is bypassed because the payload is stored as a serialized string containing no HTML tags for kses to tokenize, and the shortcode callback re-emits attacker-controlled values — including view_all_link (href attribute), main_heading_title (h2 body), button_text (anchor body), and button_inline_svg (anchor body) — without any escaping at render time.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS