Security Alert Summary
The Live Composer – Free WordPress Website Builder plugin contains a stored cross-site scripting (XSS) vulnerability in the dslc_module_downloads_output shortcode content. In affected versions up to and including 2.1.21, insufficient input sanitization and missing output escaping allow authenticated users with contributor-level access or higher to inject JavaScript that executes when an injected page is viewed.
CVE Details
- CVE ID: CVE-2026-16778
- Affected component: Live Composer – Free WordPress Website Builder plugin (shortcode
dslc_module_downloads_output) - Affected versions: All versions up to and including 2.1.21
- Published: September 22, 2026 at 8:16:38 AM UTC
- Last modified: September 22, 2026 at 11:17:23 AM UTC
- CVSS v3.1: Base score 6.4, MEDIUM; vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Requires authenticated attacker with low privileges (contributor-level access or higher). No user interaction required.
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Scope: Changed
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The plugin stores shortcode content for the dslc_module_downloads_output module as a serialized string. A save-time check using wp_kses_post is bypassed because the attacker-controlled payload is stored without HTML tags that kses would tokenize, allowing malicious input to persist. At render time the shortcode callback re-emits attacker-controlled values without escaping, including the view_all_link (href attribute), main_heading_title (h2 body), button_text (anchor body), and button_inline_svg (anchor body).
Because output escaping is missing when these values are rendered, injected scripts can be stored in content and will execute in the context of any user who loads the affected page. The issue exists due to insufficient input sanitization for serialized shortcode content and lack of proper escaping on output.
How This Could Impact Your Website
Consider a site where the site owner manages overall settings, internal staff publish content, and an external contractor or contributor edits pages. A contributor-level user could inject script into a downloads module on a public or internal page. When an internal staff member or the site owner views that page, the script can execute in their browser.
- Injected scripts could capture data visible in the browser, such as internal user names or email addresses displayed on the page.
- Captured information could increase the risk of targeted phishing or social engineering against staff or contractors.
- Scripts could perform actions within the viewer’s browser context depending on available privileges, but the primary technical impacts reported are limited to confidentiality and integrity (both assessed as low).
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior related to content changes or unexpected scripts being served.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/downloads/module.php#L4978
- https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/downloads/module.php#L5219
- https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/downloads/module.php#L5225
- https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/downloads/module.php#L5502
- https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/downloads/module.php#L5508
- https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/downloads/module.php#L5685
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3705127%40live-composer-page-builder&new=3705127%40live-composer-page-builder
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1d072660-515c-4fd9-903b-815447786e03?source=cve
