CVE-2026-16788: Live Composer WordPress Plugin XSS Vulnerability

CVE-2026-16788 Overview

CVE-2026-16788 is a stored cross-site scripting (XSS) vulnerability in the Live Composer – Free WordPress Website Builder plugin for WordPress. The flaw affects all versions up to and including 2.1.19. The vulnerability resides in the dslc_module_projects_output shortcode, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or above to inject arbitrary web scripts. Injected scripts execute in the browser of any user who views the affected page. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Contributor-level accounts can persist JavaScript payloads inside pages, enabling session theft, privilege escalation, and drive-by attacks against site visitors and administrators.

Affected Products

Live Composer – Free WordPress Website Builder plugin (all versions ≤ 2.1.19)
WordPress sites that expose contributor-or-higher registration or accept guest contributors
Multi-author WordPress deployments using the Live Composer projects module

Discovery Timeline

2026-09-01 - CVE-2026-16788 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-16788

Vulnerability Analysis

The vulnerability originates in the projects module of Live Composer, specifically in the dslc_module_projects_output shortcode handler defined in modules/projects/module.php. Attacker-controlled shortcode attributes flow directly to rendered HTML without escaping. The affected attributes include view_all_link, main_heading_link_title, main_filter_title_all, and button_text.

WordPress applies wp_kses to post content to strip dangerous markup. However, the shortcode-aware kses handling in WordPress preserves the serialized shortcode body as a placeholder before content filtering runs. As a result, malicious attribute values pass through sanitization untouched and reach render-time sinks unescaped. A contributor can submit a post containing the vulnerable shortcode, and the injected script executes whenever an editor, administrator, or site visitor loads the page.

Root Cause

The root cause is missing output escaping on user-controlled shortcode attributes. The plugin passes raw attribute values into HTML contexts without applying esc_attr, esc_html, or esc_url at the render stage. WordPress's shortcode placeholder behavior compounds the issue by shielding the payload from wp_kses filtering during content processing.

Attack Vector

An authenticated attacker with contributor privileges authors a WordPress post containing the vulnerable dslc_module_projects_output shortcode. The attacker injects a JavaScript payload into one of the unescaped attributes such as view_all_link or button_text. When the post is previewed, published, or viewed, the script executes in the victim's browser under the site's origin. This scope-changing behavior enables session cookie theft, forced actions on behalf of higher-privileged users, and delivery of secondary payloads. See the Wordfence Vulnerability Report and the annotated Live Composer Code Reference #L6025 for the sink locations.

Detection Methods for CVE-2026-16788

Indicators of Compromise

Post revisions authored by contributor-level accounts containing [dslc_module_projects_output ...] shortcodes with attributes holding <script, javascript:, or on*= handlers.
Unexpected outbound requests from admin browser sessions to attacker-controlled domains shortly after previewing contributor content.
New administrator accounts, altered user roles, or modified plugin/theme files following contributor post activity.

Detection Strategies

Scan the wp_posts and wp_postmeta tables for the dslc_module_projects_output shortcode combined with suspicious attribute values.
Review WordPress audit logs for contributor accounts creating or editing posts that reference Live Composer project modules.
Deploy a web application firewall rule that inspects POST bodies to /wp-admin/post.php for shortcode attributes containing HTML event handlers or <script> tags.

Monitoring Recommendations

Enable verbose logging on the WordPress admin area and correlate contributor edits with subsequent admin page loads.
Alert on anomalous JavaScript execution or DOM changes on published pages using content security policy (CSP) report-only monitoring.
Track plugin version inventory across WordPress estates and flag any instance still running Live Composer ≤ 2.1.19.

How to Mitigate CVE-2026-16788

Immediate Actions Required

Update Live Composer to a version newer than 2.1.19 as soon as the vendor publishes a patched release; see the Live Composer Change Set Overview for the corrective commit.
Audit all contributor and author accounts, remove unused accounts, and rotate credentials for any account that authored posts using the projects shortcode.
Review recently published or scheduled posts for the vulnerable shortcode and remove or sanitize malicious attribute values.

Patch Information

The Live Composer development team addressed the flaw in the changeset referenced by the WordPress plugin repository. Administrators should upgrade to the fixed release identified in the Wordfence Vulnerability Report. Verify the installed version through the WordPress admin dashboard under Plugins after applying the update.

Workarounds

Restrict contributor and author registration until the plugin is patched, and require admin approval for content publication.
Deactivate the Live Composer projects module or the entire plugin if it is not actively in use.
Deploy a web application firewall rule that blocks requests containing dslc_module_projects_output attributes with script-like payloads.

bash

# Configuration example: locate the vulnerable shortcode in the WordPress database
wp db query "SELECT ID, post_author, post_status FROM wp_posts \
  WHERE post_content LIKE '%dslc_module_projects_output%' \
  AND (post_content LIKE '%<script%' \
       OR post_content LIKE '%javascript:%' \
       OR post_content REGEXP 'on[a-z]+=');"