CVE-2026-16786: Live Composer WordPress Plugin XSS Vulnerability

CVE-2026-16786 Overview

CVE-2026-16786 is a stored Cross-Site Scripting (XSS) vulnerability in the Live Composer – Free WordPress Website Builder plugin for WordPress. The flaw affects all versions up to and including 2.1.19. Insufficient input sanitization and output escaping in the dslc_module_testimonials_output shortcode allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. The injected payload executes whenever a user visits an affected page. The vulnerability is categorized under CWE-79.

Critical Impact
Authenticated contributors can persist malicious JavaScript inside testimonial shortcode attributes, which executes in visitors' browsers and can lead to session theft, account takeover, or administrative privilege escalation.

Affected Products

Live Composer – Free WordPress Website Builder plugin for WordPress
All versions up to and including 2.1.19
WordPress sites permitting contributor-level or higher user registration

Discovery Timeline

2026-09-01 - CVE-2026-16786 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-16786

Vulnerability Analysis

The vulnerability resides in the dslc_module_testimonials_output shortcode handler in the plugin's modules/testimonials/module.php file. The shortcode accepts multiple user-controlled attributes, including main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all. These attribute values are rendered into the page markup without proper output escaping.

A contributor authors post content that contains the crafted shortcode. WordPress applies wp_kses_post filtering at save time, but KSES treats shortcode delimiters as opaque strings. As a result, malicious attribute payloads are preserved intact. The payload is only expanded when do_shortcode() runs during page rendering, bypassing the save-time sanitizer entirely.

Because the shortcode output writes attacker-supplied strings directly into HTML contexts, an attacker can break out of attribute contexts and inject <script> elements or event-handler attributes. The scope-change component of the vulnerability reflects that the injected script executes in the browser context of any site visitor, including administrators.

Root Cause

The root cause is missing output escaping on shortcode attributes rendered by the testimonials module. Functions such as esc_attr(), esc_url(), and esc_html() are not applied to the four impacted parameters before those values are concatenated into the output HTML. Reliance on wp_kses_post at save time is misplaced, because KSES does not parse or sanitize the interior of shortcode tags.

Attack Vector

The attack requires an authenticated account with contributor-level access or above and network access to the WordPress site. The attacker creates or edits a post containing a [dslc_module_testimonials_output] shortcode with a malicious value in one of the vulnerable attributes. When any visitor loads the page, do_shortcode() renders the payload and the injected JavaScript executes with the visitor's session context.

Exploitation does not require additional user interaction beyond visiting the affected page. The impacted attributes and their rendering locations are documented in the Live Composer testimonials module source and the Wordfence vulnerability analysis.

Detection Methods for CVE-2026-16786

Indicators of Compromise

Post or page content containing [dslc_module_testimonials_output] shortcodes with attribute values that include <script, javascript:, onerror=, onload=, or other event-handler syntax
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages that use the testimonials module
New or modified WordPress administrator accounts created shortly after contributor-authored content was published
Session cookie theft or unauthorized API calls originating from valid administrator sessions

Detection Strategies

Query the wp_posts table for post_content values matching dslc_module_testimonials_output combined with suspicious attribute payloads
Review WordPress audit logs for contributor-role users creating or editing posts that embed the affected shortcode
Inspect rendered HTML of pages using the testimonials module for unescaped <, >, or quote characters inside attribute values

Monitoring Recommendations

Enable a web application firewall to block requests containing common XSS payload patterns targeting shortcode attributes
Monitor WordPress user role changes and privilege escalations correlated with recent contributor activity
Alert on Content Security Policy (CSP) violation reports referencing inline script execution on plugin-rendered pages

How to Mitigate CVE-2026-16786

Immediate Actions Required

Update the Live Composer – Free WordPress Website Builder plugin to a version later than 2.1.19 once released by the vendor
Audit all contributor, author, and editor accounts, and remove or suspend accounts that are unused or unverified
Review recent posts and pages containing the dslc_module_testimonials_output shortcode and sanitize or remove malicious attribute values
Rotate administrator credentials and invalidate active sessions if signs of XSS execution are found

Patch Information

The vendor commit resolving the issue is tracked in the Live Composer changeset 3662813. Site administrators should install the fixed release through the WordPress plugin update mechanism as soon as it is available. Additional analysis is available in the Wordfence advisory.

Workarounds

Disable the Live Composer plugin until an updated version is installed if the testimonials module is in use
Restrict post-editing capabilities for contributor-role users through a role-management plugin
Deploy a Content Security Policy that prohibits inline scripts and restricts script sources to trusted origins
Remove [dslc_module_testimonials_output] shortcodes from published content until the patch is applied

bash

# Example: locate posts containing the vulnerable shortcode via WP-CLI
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%dslc_module_testimonials_output%' \
  AND post_status IN ('publish','draft','pending');"