CVE-2026-16778: Live Composer WordPress Plugin XSS Vulnerability

CVE-2026-16778 Overview

CVE-2026-16778 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Live Composer – Free WordPress Website Builder plugin. The flaw affects all versions up to and including 2.1.21. It resides in the dslc_module_downloads_output shortcode, where attacker-controlled attribute values are re-emitted at render time without escaping. Authenticated users with contributor-level access or above can inject arbitrary JavaScript that executes when any visitor loads the affected page.

Critical Impact
Attackers with contributor accounts can persist JavaScript payloads on published pages, enabling session theft, forced administrative actions, and drive-by redirection against site visitors and administrators.

Affected Products

Live Composer – Free WordPress Website Builder plugin, versions through 2.1.21
WordPress sites permitting contributor-level (or higher) registration or account creation
Any published page or post embedding the dslc_module_downloads_output shortcode

Discovery Timeline

2026-09-22 - CVE-2026-16778 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-16778

Vulnerability Analysis

The vulnerability is a stored XSS issue in the Downloads module of the Live Composer page builder. The plugin serializes shortcode attributes into a string before persisting them, then reconstructs them at render time inside the dslc_module_downloads_output callback. Because the persisted payload is a serialized blob rather than raw HTML, WordPress's wp_kses_post filter finds no HTML tokens to strip and passes the content through untouched.

At render time the callback echoes several attacker-controlled attributes directly into the DOM without applying esc_attr, esc_html, or esc_url. The affected attributes include view_all_link (used as an href), main_heading_title (rendered inside an <h2> element), button_text (rendered inside an anchor body), and button_inline_svg (rendered inside an anchor body). Payloads persist across page loads and execute in the browser context of every viewer, including administrators.

Root Cause

The root cause is a mismatch between save-time and render-time sanitization. Save-time validation runs wp_kses_post against a serialized string that contains no HTML, so the filter is effectively a no-op. Render-time output then interpolates attribute values into HTML contexts without contextual escaping, violating the standard WordPress output-encoding contract.

Attack Vector

An authenticated contributor submits or edits a post containing the Downloads module shortcode with malicious values embedded in view_all_link, main_heading_title, button_text, or button_inline_svg. After the post is viewed — whether by an unauthenticated visitor or an authenticated administrator previewing the content — the injected script executes with the origin of the WordPress site. See the Wordfence Vulnerability Report and the vulnerable source lines in the WordPress Live Composer Module Code for the specific sinks.

// No verified proof-of-concept code is available.
// The vulnerability is triggered by supplying JavaScript payloads
// in the view_all_link, main_heading_title, button_text, or
// button_inline_svg attributes of the dslc_module_downloads_output shortcode.

Detection Methods for CVE-2026-16778

Indicators of Compromise

Post or page content containing dslc_module_downloads_output shortcode instances with <script>, javascript:, or event-handler substrings (for example onerror=, onload=) in the view_all_link, main_heading_title, button_text, or button_inline_svg attributes.
Unexpected contributor or author accounts created shortly before shortcode edits appear in wp_posts.
Outbound requests from browsers viewing WordPress pages to attacker-controlled domains hosting secondary payloads or credential collectors.

Detection Strategies

Query the wp_posts table for post_content matching the vulnerable shortcode and known XSS sink patterns in the four affected attributes.
Enable WordPress audit logging on post_updated and user_register events and correlate contributor edits with new script-bearing shortcode content.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from pages that render the Downloads module.

Monitoring Recommendations

Monitor web server access logs for HTTP requests to pages containing the Downloads module and flag anomalous referrer or user-agent activity following contributor edits.
Alert on administrator sessions that load pages authored by low-privilege users containing Live Composer shortcodes.
Track plugin version drift across WordPress deployments to ensure hosts remain on the patched release.

How to Mitigate CVE-2026-16778

Immediate Actions Required

Update the Live Composer – Free WordPress Website Builder plugin to the release published after version 2.1.21, as tracked in the WordPress Changeset Overview.
Audit existing posts and pages for the dslc_module_downloads_output shortcode and remove any attribute values containing script tags, event handlers, or javascript: URIs.
Review contributor, author, and editor accounts for unexpected additions and rotate credentials for accounts that authored suspicious content.

Patch Information

The plugin maintainers addressed the flaw in the version referenced by the WordPress Changeset Overview. The fix adds contextual output escaping to the attributes rendered by the dslc_module_downloads_output callback. Sites running any version up to and including 2.1.21 are vulnerable and must upgrade.

Workarounds

Temporarily disable the Live Composer plugin on sites that cannot be patched immediately.
Restrict contributor-level and higher account registration and require administrator approval for new accounts.
Deploy a strict Content Security Policy that blocks inline scripts and unauthorized external script sources to reduce exploitation impact.

bash

# Example: locate posts containing the vulnerable shortcode with likely XSS payloads
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%dslc_module_downloads_output%' \
  AND (post_content LIKE '%<script%' \
    OR post_content LIKE '%javascript:%' \
    OR post_content LIKE '%onerror=%' \
    OR post_content LIKE '%onload=%');"