{"id":"CVE-2025-15708","kind":"vulnerability","aliases":["CVE-2025-15708"],"related":[],"title":"Live Composer WordPress plugin: custom post slugs enable stored cross-site scripting","description":"The Live Composer  WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).","summary":"The Live Composer WordPress plugin does not sanitise or escape custom post type slug settings before printing them into front-end links. A high-privilege user such as an administrator can store script that runs in other visitors' browsers, even where unfiltered HTML is disallowed, such as on multisite.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["live-composer","multisite","package","wordpress"],"not_affected_if":["no-privileged-untrusted-users","plugin-not-installed","version-2.1.23-or-later"],"how_to_check":"- Check the installed Live Composer plugin version in the WordPress admin plugins list or the plugin header.\n- Look for the plugin in multisite network installs, where unfiltered_html is commonly restricted.\n- Confirm the version against the fixed release named in the sources.","fix":"- Live Composer plugin: move to version `2.1.23` or later (per the NVD description, 'before 2.1.23' is affected).","status":"open","published_at":"2026-11-07T06:16:56+00:00","first_seen_at":"2026-11-07T06:46:03+00:00","triaged_at":"2026-11-07T06:48:34+00:00","updated_at":"2026-11-07T06:48:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T06:48:34Z","model":"claude-haiku-5-5","output":{"fix":"- Live Composer plugin: move to version `2.1.23` or later (per the NVD description, 'before 2.1.23' is affected).","reach":"network","title":"Live Composer WordPress plugin: custom post slugs enable stored cross-site scripting","impact":"medium","summary":"The Live Composer WordPress plugin does not sanitise or escape custom post type slug settings before printing them into front-end links. A high-privilege user such as an administrator can store script that runs in other visitors' browsers, even where unfiltered HTML is disallowed, such as on multisite.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","live-composer","multisite"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Stored script runs in visitors' browsers, enabling session theft or admin actions","analyst_note":"","how_to_check":"- Check the installed Live Composer plugin version in the WordPress admin plugins list or the plugin header.\n- Look for the plugin in multisite network installs, where unfiltered_html is commonly restricted.\n- Confirm the version against the fixed release named in the sources.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-2.1.23-or-later","no-privileged-untrusted-users"],"who_is_affected":"Sites running the Live Composer WordPress plugin before 2.1.23, particularly multisite networks where administrators lack unfiltered HTML rights. Exploitation requires a high-privilege account to set the custom post type slug. Sites without the plugin or already on 2.1.23 or later are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000728,"input_tokens":4231,"output_tokens":609,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-15708':16A,19A '-2025':15A,18A '2.1.23':83C 'admin':113C 'administr':57B 'allow':107C 'attack':121C 'browser':66B 'capabl':127C 'compos':2A,22B,28B,79C 'could':106C 'cross':11A,118C 'cross-sit':10A,117C 'custom':5A,36B,92C 'cve':14A,17A 'disallow':72B,129C 'enabl':8A 'end':47B,103C 'escap':35B,88C 'even':67B,122C 'exampl':131C 'front':46B,102C 'front-end':45B,101C 'high':51B,108C 'high-privileg':50B 'html':70B,126C 'link':48B,104C 'live':1A,21B,27B,78C 'live-compos':20B 'multisit':23B,76B,134C 'packag':24B 'perform':115C 'plugin':4A,30B,81C 'post':6A,37B,93C 'print':42B 'privileg':52B,109C 'run':62B 'sanitis':33B,86C 'script':13A,60B,120C 'set':40B,96C 'setup':135C 'site':12A,119C 'slug':7A,39B,95C 'store':9A,59B,116C 'type':38B,94C 'unfilt':69B,125C 'use':98C 'user':53B,110C 'visitor':65B 'wordpress':3A,25B,29B,80C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Live Composer WordPress plugin before 2.1.23, particularly multisite networks where administrators lack unfiltered HTML rights. Exploitation requires a high-privilege account to set the custom post type slug. Sites without the plugin or already on 2.1.23 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["livecomposer","low","multisite","package","wordpress"],"campaign_type":null,"search_a":"'-15708':16A,19A '-2025':15A,18A 'compos':2A 'cross':11A 'cross-sit':10A 'custom':5A 'cve':14A,17A 'enabl':8A 'live':1A 'plugin':4A 'post':6A 'script':13A 'site':12A 'slug':7A 'store':9A 'wordpress':3A","search_b":"'administr':57B 'browser':66B 'compos':22B,28B 'custom':36B 'disallow':72B 'end':47B 'escap':35B 'even':67B 'front':46B 'front-end':45B 'high':51B 'high-privileg':50B 'html':70B 'link':48B 'live':21B,27B 'live-compos':20B 'multisit':23B,76B 'packag':24B 'plugin':30B 'post':37B 'print':42B 'privileg':52B 'run':62B 'sanitis':33B 'script':60B 'set':40B 'slug':39B 'store':59B 'type':38B 'unfilt':69B 'user':53B 'visitor':65B 'wordpress':25B,29B","search_c":"'2.1.23':83C 'admin':113C 'allow':107C 'attack':121C 'capabl':127C 'compos':79C 'could':106C 'cross':118C 'cross-sit':117C 'custom':92C 'disallow':129C 'end':103C 'escap':88C 'even':122C 'exampl':131C 'front':102C 'front-end':101C 'high':108C 'html':126C 'link':104C 'live':78C 'multisit':134C 'perform':115C 'plugin':81C 'post':93C 'privileg':109C 'sanitis':86C 'script':120C 'set':96C 'setup':135C 'site':119C 'slug':95C 'store':116C 'type':94C 'unfilt':125C 'use':98C 'user':110C 'wordpress':80C","first_public_at":"2026-11-07T06:16:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-15708","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15708","severity":null,"published_at":"2026-11-07T06:16:56+00:00","modified_at":"2026-11-07T06:16:56+00:00","first_seen_at":"2026-11-07T06:46:03+00:00","fetched_at":"2026-11-07T06:46:03+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}