CVE-2026-16787 Overview
CVE-2026-16787 is a Stored Cross-Site Scripting (XSS) vulnerability in the Live Composer – Free WordPress Website Builder plugin for WordPress. The flaw affects all versions up to and including 2.1.19 and resides in the dslc_custom_field shortcode handler. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views an affected page, enabling session theft, account takeover of higher-privileged users, or redirection to attacker-controlled infrastructure. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Authenticated contributors can persist JavaScript payloads that execute for administrators and site visitors, enabling privilege escalation via session hijacking or forced administrative actions.
Affected Products
- Live Composer – Free WordPress Website Builder plugin, all versions through 2.1.19
- WordPress sites running the live-composer-page-builder plugin
- Sites permitting contributor-or-higher user registration with the plugin active
Discovery Timeline
- 2026-09-01 - CVE-2026-16787 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-16787
Vulnerability Analysis
The Live Composer page builder registers a shortcode named dslc_custom_field that renders values pulled from post meta fields into rendered page output. In vulnerable builds, the shortcode handler in includes/shortcodes.php reads user-controlled attributes and post meta content, then emits them into the page HTML without applying sufficient sanitization or escaping. An authenticated user with contributor-level access can therefore embed a shortcode invocation, or manipulate associated meta values, so that arbitrary <script> payloads are stored in post content or metadata.
When a visitor or higher-privileged reviewer loads the containing page, the payload executes with the origin of the WordPress site. This allows the attacker to read authenticated session context, issue REST API requests on behalf of an administrator, or plant persistent backdoors through plugin or theme editors. The stored nature of the flaw means every page render is an execution opportunity, without requiring further interaction from the attacker.
Root Cause
The root cause is the absence of proper escaping functions such as esc_html(), esc_attr(), or wp_kses_post() around the values returned by the shortcode callback. Contributor-level content is treated as trusted output, violating the WordPress guidance that all dynamic values must be escaped at the point of rendering. See the vulnerable code references at shortcodes.php L84, L88, and L89.
Attack Vector
An attacker registers or obtains a contributor account, then submits a draft post containing the dslc_custom_field shortcode with a crafted attribute or meta reference that resolves to a JavaScript payload. Once the post is previewed or published, the payload is stored in the database. Any authenticated administrator reviewing the submission, or any visitor viewing the page, triggers execution of the injected script in their browser session.
The vulnerability does not require file uploads or elevated privileges beyond the contributor role, and no user interaction is required beyond loading the page. Because the scope is changed (S:C in the CVSS vector), the impact reaches beyond the plugin's own security boundary into the surrounding WordPress site.
No verified public exploit code is available at the time of publication. See the Wordfence Vulnerability Analysis for additional technical detail.
Detection Methods for CVE-2026-16787
Indicators of Compromise
- Post content or post meta entries containing [dslc_custom_field] shortcode invocations with attributes that reference <script>, onerror, onload, or javascript: values.
- Unexpected outbound HTTP requests originating from administrator browsers to unfamiliar domains shortly after reviewing contributor submissions.
- New WordPress administrator accounts, modified user roles, or altered plugin and theme files created without a corresponding audit trail.
Detection Strategies
- Query the wp_posts and wp_postmeta tables for shortcode occurrences containing script tags, event handlers, or encoded JavaScript payloads.
- Enable WordPress security logging to record shortcode rendering, user role changes, and REST API activity performed by administrator sessions.
- Deploy a Web Application Firewall rule that inspects requests to wp-admin/post.php and wp-admin/admin-ajax.php for reflected script content submitted by contributor accounts.
Monitoring Recommendations
- Monitor authentication logs for newly registered contributor accounts followed shortly by post creation or edit actions.
- Alert on administrator sessions that generate anomalous XHR or fetch requests to /wp-json/wp/v2/users or the plugin and theme editor endpoints.
- Track file integrity for wp-content/plugins/live-composer-page-builder/ and core WordPress files to catch post-exploitation persistence.
How to Mitigate CVE-2026-16787
Immediate Actions Required
- Update the Live Composer plugin to the version released in Changeset 3662813, which addresses the shortcode escaping issue.
- Audit contributor, author, and editor accounts and disable any that are unrecognized or inactive.
- Review all posts and post meta for stored shortcode payloads and remove malicious content before restoring publication.
Patch Information
The vendor addressed the flaw in the commit referenced by WordPress Plugin Changeset 3662813. The patched release supersedes version 2.1.19. Administrators should apply the update through the WordPress plugin manager or by deploying the fixed package directly to wp-content/plugins/live-composer-page-builder/.
Workarounds
- Restrict user registration and set the default role to subscriber until the patched plugin version is deployed.
- Temporarily deactivate the Live Composer plugin if patching cannot be performed immediately.
- Apply a WAF rule to block shortcode attributes containing <script, javascript:, or event handler patterns in POST requests to WordPress editor endpoints.
# Configuration example: update the plugin via WP-CLI
wp plugin update live-composer-page-builder
wp plugin get live-composer-page-builder --field=version
# Optional: restrict registration until patched
wp option update users_can_register 0
wp option update default_role subscriber
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
