CVE-2026-16787: Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode

Q: Who can exploit this issue?

An attacker must be authenticated to WordPress with at least Contributor-level access. They can inject script through the dslc_custom_field shortcode into a page.

Q: When does the malicious script run, and who may be affected?

The injected script executes whenever a user accesses the affected page. This can affect any user who visits a page containing the stored payload.

Q: Which installations are affected?

All Live Composer versions up to and including 2.1.19 are affected. The provided data does not identify a fixed version.

Published Sep 1, 2026

Updated

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslccustomfield' Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected Software

1 affected component

Live Composer Live Composer – Free WordPress Website Builder<=2.1.19

Event History

Sep 1, 2026

CVE Published

via MITRE·04:27 AM

Data Sourced

via MITRE·04:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to WordPress with at least Contributor-level access. They can inject script through the dslc_custom_field shortcode into a page.

When does the malicious script run, and who may be affected?

The injected script executes whenever a user accesses the affected page. This can affect any user who visits a page containing the stored payload.

Which installations are affected?

All Live Composer versions up to and including 2.1.19 are affected. The provided data does not identify a fixed version.

CVE-2026-16787: Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

When does the malicious script run, and who may be affected?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

When does the malicious script run, and who may be affected?

Which installations are affected?