Is CVE-2026-16778 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16778 being exploited in the wild.

How severe is CVE-2026-16778?

Medium severity, with a CVSS score of 6.4, published 22 September 2026.

Which products and versions are affected?

Live Composer Free WordPress Website Builder up to and including 2.1.21.

Is there a fix for CVE-2026-16778?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16778 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-16778?

Check whether you run Live Composer Free WordPress Website Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16778: Live Composer stored cross-site scripting in downloads shortcode

CVE-2026-16778 · Severity: medium · CVSS 6.4 · Published 2026-09-22

The Live Composer website builder plugin for WordPress contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious scripts into page content. When other users visit an affected page, the injected scripts execute in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability bypasses security checks by storing payloads as serialized data that escapes initial filtering, then outputs them unescaped during page rendering.

Technologies: Live Composer Free WordPress Website Builder. Vendors: Live Composer.

Quick answers

Is CVE-2026-16778 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16778 being exploited in the wild.
How severe is CVE-2026-16778?: Medium severity, with a CVSS score of 6.4, published 22 September 2026.
Which products and versions are affected?: Live Composer Free WordPress Website Builder up to and including 2.1.21.
Is there a fix for CVE-2026-16778?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16778 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-16778?: Check whether you run Live Composer Free WordPress Website Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the downloads module's shortcode handler, which fails to escape output from attacker-controlled attributes (view_all_link, main_heading_title, button_text, button_inline_svg) when rendering page content. An authenticated attacker with contributor-level access can bypass initial wp_kses_post sanitization by storing payloads as serialized strings that contain no HTML tags for the filter to detect, exploiting the gap between save-time validation and render-time output emission. This stored XSS executes whenever any user accesses the compromised page.

Affected products

Live Composer Free WordPress Website Builder up to and including 2.1.21

Timeline

2026-09-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.