Live Composer CVE-2026-16786

Exploitation requires an authenticated WordPress session with at least contributor-level permissions - this is the primary gate and the main limiting factor against opportunistic mass exploitation. The Live Composer plugin must be installed, active, and running version 2.1.19 or earlier. The specific attack surface is the dslc_module_testimonials_output shortcode; the attacker must be able to create or edit a post or page that includes this shortcode and control the values of the main_heading_title, view_all_link, main_heading_link_title, or main_filter_title_all attributes. Payload detonation against a victim requires a second user to browse to the injected page - the stored nature of the XSS means no attacker presence is needed at execution time, but victim page-load interaction is required. Sites where contributor registration is closed or tightly provisioned are substantially protected by the PR:L prerequisite.

The CVSS 3.1 base score of 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N reflects a network-reachable, low-complexity attack constrained by a contributor-level authentication prerequisite and producing a scope change - the injected payload executes in other users' browser sessions. The PR:L requirement is the primary real-world limiting factor: an attacker must hold or obtain a valid WordPress contributor account, which narrows opportunistic exploitation but remains realistic on multi-author blogs, news sites, and editorial platforms where contributor registration is open or loosely managed. No EPSS score was supplied, so exploitation probability cannot be quantified numerically; the absence of a CISA KEV listing indicates no confirmed widespread active exploitation. The scope change (S:C) combined with administrator visit potential means the practical blast radius exceeds what the nominal score suggests - a successful payload can steal admin session cookies or redirect privileged users, enabling full site takeover. This is a moderate-to-elevated priority for WordPress deployments with open contributor-level registration and a lower priority where contributor access is tightly controlled.

An attacker registers or compromises a contributor account on a target WordPress site running Live Composer 2.1.19 or earlier, then creates or edits a page embedding the dslc_module_testimonials_output shortcode with a JavaScript payload in the main_heading_title or view_all_link attribute; the payload survives save-time sanitization because wp_kses_post does not inspect shortcode contents. When any user - including an administrator - subsequently visits the page, do_shortcode() renders the unescaped attribute into live HTML, executing the script in the visitor's browser and enabling session cookie theft or arbitrary DOM manipulation. No public proof-of-concept has been identified at time of analysis, but the attack is fully reproducible from the vulnerability description and referenced source lines alone.