CVE-2026-16786: Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives save-time wpksespost filtering because KSES treats shortcode delimiters as opaque, and the unescaped fields — including mainheadingtitle, viewalllink, mainheadinglinktitle, and mainfiltertitleall — are only rendered when doshortcode() executes at page-view time.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Live Composer – Free WordPress Website Builder (WordPress plugin)to a version that resolves this vulnerability.Fixed in 2.1.19 - Compensating control
Restrict contributor-level (and higher) accounts from editing pages containing the dslc_module_testimonials_output shortcode until the plugin is remediated, since the stored XSS executes when do_shortcode() renders at page-view time.
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated with Contributor-level access or higher. No user interaction is required from the attacker after they save the malicious shortcode payload.
When does the injected script execute?
The payload is stored in a page and executes when a user accesses that injected page. The affected shortcode fields are rendered during page viewing when do_shortcode() executes.
Why does WordPress save-time filtering not prevent the payload?
The payload can survive wp_kses_post filtering because KSES treats shortcode delimiters as opaque. The affected shortcode fields are not escaped when they are later rendered.
Which shortcode fields are implicated?
The unescaped fields identified are main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all in the dslc_module_testimonials_output shortcode.