CVE-2026-16787: Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslccustomfield' Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress with at least Contributor-level access. They can inject script through the dslc_custom_field shortcode into a page.
When does the malicious script run, and who may be affected?
The injected script executes whenever a user accesses the affected page. This can affect any user who visits a page containing the stored payload.
Which installations are affected?
All Live Composer versions up to and including 2.1.19 are affected. The provided data does not identify a fixed version.