CVE-2026-16786

Name of the Vulnerable Software and Affected Versions Live Composer – Free WordPress Website Builder versions prior to 2.1.20

Description Stored Cross-Site Scripting occurs via the dslc module testimonials output shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user views the affected page. The issue persists because the wp kses post filter treats shortcode delimiters as opaque, allowing unescaped fields such as main heading title, view all link, main heading link title, and main filter title all to be rendered during the execution of the do shortcode() function at page-view time.

Recommendations Update to a version later than 2.1.19.