Live Composer CVE-2026-16788

Exploitation requires an authenticated WordPress session with at minimum contributor-level role (CVSS PR:L confirmed). The attack path is specifically gated on the Live Composer plugin being installed and activated with versions at or below 2.1.19, and on the dslc_module_projects_output shortcode being used in a post or page - the attacker must have permission to create or edit content containing this shortcode. The kses bypass is the critical enabling condition: it is triggered by WordPress core's shortcode serialization behavior during post save, which is a default WordPress behavior when any registered shortcode is present in content, not a non-default configuration. Exploitation is limited to: WordPress installations with this specific plugin active; contributor accounts or higher (editor, admin-level authors are also capable but would represent insider threat); and victim-browser impact requires a visitor to load the page containing the injected shortcode (UI:N from the attacker's perspective, but visitor action is the trigger for the payload). Scope is limited to the victim browser session - no direct server-side code execution is involved.

The CVSS 6.4 score reflects a meaningful balance of factors: network reachability (AV:N), low complexity (AC:L), low-privilege authentication requirement (PR:L for contributor role), no required attacker-side user interaction (UI:N), and a scope change (S:C) with low Confidentiality and Integrity impact on downstream systems. The authentication prerequisite is the primary real-world mitigation: the attacker must control a contributor-level account, which on tightly managed sites represents a significant barrier. On loosely administered platforms - news sites, educational portals, agency-managed properties with many contributor accounts - that bar is far lower, and even a mid-sized municipal IT team in walbrzych running a public-facing WordPress site with open contributor registration should treat this as urgent patching rather than a deferred medium-priority item. No EPSS probability score was supplied in the input, so quantitative exploitation-likelihood assessment is not possible. No KEV listing and no public POC are identified at time of analysis, suggesting opportunistic mass exploitation is not currently occurring; however, the kses shortcode bypass technique is well understood in WordPress security research circles, and the low privilege requirement makes targeted exploitation straightforward for any actor already holding a contributor credential.

An attacker obtains or registers a contributor account on the target WordPress site, then creates a post embedding a dslc_module_projects_output shortcode with a malicious JavaScript payload injected into the button_text or view_all_link attribute; WordPress's kses filter preserves the shortcode body opaquely, allowing the payload to persist in the database unescaped. When any user - including a site administrator - subsequently loads the injected page, their browser executes the script, enabling the attacker to exfiltrate session cookies or issue authenticated WordPress API requests to create a rogue administrator account. No public POC has been identified, but the kses-shortcode bypass vector is technically straightforward for anyone familiar with WordPress plugin XSS patterns.