CVE-2026-16788: Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduleprojectsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress's shortcode-aware kses handling preserves the serialized shortcode body as a placeholder before content filtering runs, allowing attacker-controlled values such as viewalllink, mainheadinglinktitle, mainfiltertitleall, and buttontext to reach render-time sinks entirely unescaped.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Live Composerto a version that resolves this vulnerability.Fixed in 2.1.19 - Configuration
Mitigate the Stored XSS by ensuring that values injected via the dslc_module_projects_output shortcode attributes (e.g., view_all_link, main_heading_link_title, main_filter_title_all, button_text) are properly sanitized on input and escaped on output at render time.
WordPress (shortcode handler) Enable sanitization/escaping for shortcode attributes used by dslc_module_projects_output = sanitized and escaped
Event History
Frequently Asked Questions
Does exploitation require administrator-level access?
No. An attacker needs an authenticated WordPress account with Contributor privileges or higher; administrator access is not required.
When would a malicious payload run?
The injected script executes when a user accesses a page containing the attacker-controlled shortcode. No additional user interaction beyond viewing the affected page is described.
What content should administrators review for signs of exploitation?
Review pages containing the dslc_module_projects_output shortcode, particularly values supplied to view_all_link, main_heading_link_title, main_filter_title_all, and button_text. These values can reach rendering sinks without escaping.