Stored Cross-Site Scripting Vulnerability in Live Composer Plugin for WordPress

CVE-2026-16778

What is CVE-2026-16778?

The Live Composer plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'dslc_module_downloads_output' shortcode. This issue arises due to inadequate input sanitization and output escaping across all versions up to 2.1.21. Authenticated attackers with contributor-level access can exploit this vulnerability to inject arbitrary scripts into web pages that execute when users visit these pages. The vulnerability involves the storage of payloads as serialized strings, which the wp_kses_post check fails to process correctly, thus allowing attackers to control elements such as hyperlinks and text content without any escaping at render time.

References