Stored Cross-Site Scripting Vulnerability in Live Composer Plugin for WordPress

CVE-2026-16787

What is CVE-2026-16787?

The Live Composer plugin for WordPress is susceptible to a stored cross-site scripting (XSS) vulnerability due to improper input sanitization in the 'dslc_custom_field' shortcode. This flaw allows authenticated users with contributor-level access and higher to inject arbitrary scripts into pages, which are executed when other users access the compromised pages. This vulnerability highlights the importance of robust input handling and output escaping practices in maintaining the security of web applications.

References