CVE-2025-15708 · Package
NO FIX YET · SEE WHAT TO DO
The Live Composer WordPress plugin does not sanitise or escape custom post type slug settings before printing them into front-end links. A high-privilege user such as an administrator can store script that runs in other visitors' browsers, even where unfiltered HTML is disallowed, such as on multisite.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Live Composer WordPress plugin before 2.1.23, particularly multisite networks where administrators lack unfiltered HTML rights. Exploitation requires a high-privilege account to set the custom post type slug. Sites without the plugin or already on 2.1.23 or later are not affected.
Not affected if no-privileged-untrusted-users, plugin-not-installed, version-2.1.23-or-later
Who cares live-composer, multisite, wordpress
2.1.23 or later (per the NVD description, 'before 2.1.23' is affected).The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.