CVE-2026-16788

Name of the Vulnerable Software and Affected Versions Live Composer – Free WordPress Website Builder versions prior to 2.1.20

Description Stored Cross-Site Scripting occurs via the dslc module projects output shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. This is possible because WordPress's shortcode-aware kses handling preserves the serialized shortcode body as a placeholder before content filtering, allowing the variables view all link, main heading link title, main filter title all, and button text to reach render-time sinks without being escaped.

Recommendations Update to a version newer than 2.1.19.