{"id":"CVE-2025-15711","kind":"vulnerability","aliases":["CVE-2025-15711"],"related":[],"title":"Live Composer WordPress plugin: stored XSS via module settings in links","description":"The Live Composer  WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups).","summary":"The Live Composer WordPress plugin before 2.1.24 does not sanitise or escape some module settings before writing them into an href attribute. An administrator can store script that runs in other users' browsers, even where unfiltered HTML is disallowed, such as multisite setups.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["live-composer","multisite","package","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-2.1.24-or-later"],"how_to_check":"- Check the installed Live Composer plugin version in the WordPress admin Plugins page; versions below `2.1.24` are affected.","fix":"- Live Composer plugin: upgrade to `2.1.24` or later.","status":"open","published_at":"2026-11-11T06:17:08+00:00","first_seen_at":"2026-11-11T06:25:39+00:00","triaged_at":"2026-11-11T06:29:11+00:00","updated_at":"2026-11-11T06:29:11+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T06:29:11Z","model":"claude-haiku-5-5","output":{"fix":"- Live Composer plugin: upgrade to `2.1.24` or later.","reach":"network","title":"Live Composer WordPress plugin: stored XSS via module settings in links","impact":"medium","summary":"The Live Composer WordPress plugin before 2.1.24 does not sanitise or escape some module settings before writing them into an href attribute. An administrator can store script that runs in other users' browsers, even where unfiltered HTML is disallowed, such as multisite setups.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","live-composer","multisite"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Stored script runs in other users' browsers, enabling session hijacking.","analyst_note":"","how_to_check":"- Check the installed Live Composer plugin version in the WordPress admin Plugins page; versions below `2.1.24` are affected.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-2.1.24-or-later","plugin-not-installed"],"who_is_affected":"Sites running the Live Composer WordPress plugin before 2.1.24, especially multisite installs where administrators lack the unfiltered_html capability. Exploitation requires an account with high privileges, so sites with only trusted administrators carry less risk. Sites without this plugin are not affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000724,"input_tokens":4558,"output_tokens":536,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-15711':14A,17A '-2025':13A,16A '2.1.24':30B,73C 'administr':47B,100C 'allow':93C 'attack':108C 'attribut':45B,90C 'browser':56B 'capabl':114C 'compos':2A,20B,26B,69C 'could':92C 'cross':105C 'cross-sit':104C 'cve':12A,15A 'disallow':62B,116C 'e.g':117C 'escap':35B,78C 'even':57B,109C 'high':95C 'high-privileg':94C 'href':44B,89C 'html':60B,113C 'link':11A 'live':1A,19B,25B,68C 'live-compos':18B 'modul':8A,37B,82C 'multisit':21B,65B,119C 'output':85C 'packag':22B 'perform':102C 'plugin':4A,28B,71C 'privileg':96C 'run':52B 'sanitis':33B,76C 'script':50B,107C 'set':9A,38B,83C 'setup':66B,120C 'site':106C 'store':5A,49B,103C 'unfilt':59B,112C 'user':55B,97C 'via':7A 'wordpress':3A,23B,27B,70C 'write':40B 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Live Composer WordPress plugin before 2.1.24, especially multisite installs where administrators lack the unfiltered_html capability. Exploitation requires an account with high privileges, so sites with only trusted administrators carry less risk. Sites without this plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["livecomposer","low","multisite","package","wordpress"],"campaign_type":null,"search_a":"'-15711':14A,17A '-2025':13A,16A 'compos':2A 'cve':12A,15A 'link':11A 'live':1A 'modul':8A 'plugin':4A 'set':9A 'store':5A 'via':7A 'wordpress':3A 'xss':6A","search_b":"'2.1.24':30B 'administr':47B 'attribut':45B 'browser':56B 'compos':20B,26B 'disallow':62B 'escap':35B 'even':57B 'href':44B 'html':60B 'live':19B,25B 'live-compos':18B 'modul':37B 'multisit':21B,65B 'packag':22B 'plugin':28B 'run':52B 'sanitis':33B 'script':50B 'set':38B 'setup':66B 'store':49B 'unfilt':59B 'user':55B 'wordpress':23B,27B 'write':40B","search_c":"'2.1.24':73C 'administr':100C 'allow':93C 'attack':108C 'attribut':90C 'capabl':114C 'compos':69C 'could':92C 'cross':105C 'cross-sit':104C 'disallow':116C 'e.g':117C 'escap':78C 'even':109C 'high':95C 'high-privileg':94C 'href':89C 'html':113C 'live':68C 'modul':82C 'multisit':119C 'output':85C 'perform':102C 'plugin':71C 'privileg':96C 'sanitis':76C 'script':107C 'set':83C 'setup':120C 'site':106C 'store':103C 'unfilt':112C 'user':97C 'wordpress':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-15711","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15711","severity":null,"published_at":"2026-11-11T06:17:08+00:00","modified_at":"2026-11-11T06:17:08+00:00","first_seen_at":"2026-11-11T06:25:39+00:00","fetched_at":"2026-11-11T06:25:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}