CVE-2026-16787

Name of the Vulnerable Software and Affected Versions Live Composer – Free WordPress Website Builder versions prior to 2.1.20

Description Insufficient input sanitization and output escaping in the dslc custom field shortcode allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are injected into pages, which then execute in the browser of any user who accesses the affected page.

Recommendations Update the plugin to version 2.1.20 or later.