# CVE-2026-16788: Live Composer stored cross-site scripting via dslc_module_projects shortcode

Source: https://junglewise.ai/threats/cve-2026-16788-live-composer-stored-cross-site-scripting-via-dslc-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16788 · Severity: medium · CVSS 6.4 · Published 2026-09-01

The Live Composer page builder plugin for WordPress contains a flaw that allows authenticated users with contributor access to inject malicious scripts into pages. When visitors view a page containing an injected script, it will execute in their browser, potentially stealing session data, redirecting users, or performing actions on their behalf. The vulnerability affects all versions up to 2.1.19.

Technologies: [Live Composer Free WordPress Website Builder](https://junglewise.ai/threats/technologies/free-wordpress-website-builder). Vendors: [Live Composer](https://junglewise.ai/threats/vendors/live-composer).

## Quick answers

**Is CVE-2026-16788 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16788 being exploited in the wild.

**How severe is CVE-2026-16788?** Medium severity, with a CVSS score of 6.4, published 1 September 2026.

**Which products and versions are affected?** Live Composer Free WordPress Website Builder up to and including 2.1.19.

**Is there a fix for CVE-2026-16788?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16788 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16788?** Check whether you run Live Composer Free WordPress Website Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the dslc_module_projects_output shortcode handler. The root cause is insufficient input sanitization and output escaping of user-supplied parameters such as view_all_link, main_heading_link_title, main_filter_title_all, and button_text. WordPress's shortcode processing preserves serialized shortcode bodies as placeholders before content filtering, allowing attacker-controlled values to bypass sanitization and reach the render-time output sink unescaped. An authenticated attacker with contributor-level or higher privileges can inject arbitrary JavaScript into pages via the affected shortcode parameters. When other users access these pages, the injected script executes in their browser context. A patch is required to properly escape or sanitize these parameters at output time.

## Affected products

- Live Composer Free WordPress Website Builder up to and including 2.1.19

## Timeline

- 2026-09-01: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/projects/module.php](https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/projects/module.php)
- [https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/projects/module.php](https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/projects/module.php)

## Related threats

- [Live Composer stored cross-site scripting in downloads shortcode](https://junglewise.ai/threats/cve-2026-16778-the-live-composer-free-wordpress-website-builder-plugin-for)
- [Live Composer stored cross-site scripting in custom field shortcode](https://junglewise.ai/threats/cve-2026-16787-live-composer-stored-cross-site-scripting-in-custom-field)
- [Live Composer Free WordPress Website Builder stored XSS in custom_id shortcode attribute](https://junglewise.ai/threats/cve-2026-13203-live-composer-free-wordpress-website-builder-stored-xss-in-custom)