CVE-2026-16778

Name of the Vulnerable Software and Affected Versions Live Composer – Free WordPress Website Builder versions prior to 2.1.22

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the dslc module downloads output shortcode content. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. The issue arises because the wp kses post check is bypassed when the payload is stored as a serialized string. Subsequently, the shortcode callback re-emits attacker-controlled values without escaping at render time, specifically affecting the view all link (href attribute), main heading title (h2 body), button text (anchor body), and button inline svg (anchor body).

Recommendations Update Live Composer – Free WordPress Website Builder to version 2.1.22 or later.