CVE-2025-15712 · Package
NO FIX YET · SEE WHAT TO DO
The Live Composer WordPress plugin before 2.1.24 does not sanitise or escape some staff member settings before printing them on pages. An administrator can store script that runs in other users' browsers, even where the unfiltered_html capability is disabled, such as multisite setups.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Live Composer WordPress plugin before version 2.1.24, particularly multisite installations where administrators are not allowed unfiltered HTML. The attacker needs an administrator-level account, so sites that limit who holds admin rights face less risk. Sites already on 2.1.24 or later are not affected.
Not affected if no-admin-accounts-untrusted, plugin-version-2.1.24-or-later
Who cares live-composer, multisite, wordpress
2.1.24 are affected.unfiltered_html, since that is where the sources say the flaw matters.2.1.24 or later.The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in pages, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups).
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.