CVE-2026-16787 in Live Composer Plugin
Summary
by MITRE • 09/01/2026
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The Live Composer plugin, known officially as SiteOrigin Page Builder, is a widely utilized WordPress website builder that allows users to create dynamic content through visual editing tools and shortcodes. A critical security vulnerability has been identified within this software affecting all versions up to and including 2.1.19. The flaw resides specifically in the handling of the dslc_custom_field shortcode, which is designed to allow developers and site administrators to insert custom data fields into pages. This component fails to adequately sanitize user-supplied input or properly escape output when rendering these custom fields, creating a pathway for malicious actors to execute arbitrary JavaScript code within the context of legitimate web pages served by the WordPress installation.
This vulnerability constitutes a Stored Cross-Site Scripting flaw, categorized under CWE-79 in the Common Weakness Enumeration standard. Unlike reflected XSS attacks where malicious scripts are executed immediately upon request, stored vulnerabilities persist on the target server. In this specific case, an attacker with contributor-level access or higher can inject script payloads into the custom field data. Because WordPress stores this content in its database, the malicious code is saved and subsequently served to every visitor who views a page containing the compromised shortcode. This persistence transforms the vulnerability from a transient issue into a long-term threat that affects all users accessing the affected pages, not just the attacker or administrator who initially injected the payload.
The operational impact of this vulnerability is significant due to the relatively low privilege level required for exploitation. Contributor-level access in WordPress allows users to publish and manage their own posts but typically restricts them from modifying core site settings or installing plugins. By leveraging stored XSS, an attacker with these limited privileges can escalate their influence over the website environment. Successful exploitation enables the execution of arbitrary JavaScript code in the browsers of visiting users. This capability facilitates a range of malicious activities including session hijacking through cookie theft, credential harvesting via keylogging scripts, defacement of site content by manipulating DOM elements, and potentially redirecting users to phishing sites or malware distribution platforms. The trust established between the user's browser and the WordPress domain allows these attacks to bypass same-origin policy protections that would otherwise limit cross-domain data access.
From a threat intelligence perspective aligned with MITRE ATT&CK frameworks, this vulnerability maps primarily to techniques involving client-side code injection such as T1059 which covers command and script interpretation within user environments. The stored nature of the payload also aligns with persistence mechanisms where malicious content is embedded in legitimate data streams to ensure repeated execution upon access. This behavior mirrors tactics often seen in advanced persistent threats or defacement campaigns where long-term presence on a compromised system is prioritized over immediate damage.
Mitigation strategies must address both immediate remediation and future prevention measures. The most effective solution is to upgrade the Live Composer plugin to version 2.1.20 or later, which includes patches for input sanitization and output escaping mechanisms in the dslc_custom_field shortcode handling logic. Organizations relying on this plugin should prioritize updating their WordPress environments as soon as possible given the low barrier to entry for attackers requiring only contributor-level access. In addition to patching, administrators should enforce strict role-based access control policies within WordPress to ensure that user accounts with publishing privileges are assigned only to trusted individuals who understand security implications of content creation. Implementing a Web Application Firewall can provide an additional layer of defense by filtering out known XSS payloads in HTTP requests before they reach the application logic. Furthermore, enabling Content Security Policy headers on the web server can mitigate the impact of any successful injection attempts by restricting the sources from which scripts are allowed to execute, thereby reducing the effectiveness of injected malicious code even if it manages to bypass other defenses.