{"id":"CVE-2025-15712","kind":"vulnerability","aliases":["CVE-2025-15712"],"related":[],"title":"Live Composer WordPress plugin: staff settings allow stored cross-site scripting","description":"The Live Composer  WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in pages, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups).","summary":"The Live Composer WordPress plugin before 2.1.24 does not sanitise or escape some staff member settings before printing them on pages. An administrator can store script that runs in other users' browsers, even where the unfiltered_html capability is disabled, such as multisite setups.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["live-composer","multisite","package","wordpress"],"not_affected_if":["no-admin-accounts-untrusted","plugin-version-2.1.24-or-later"],"how_to_check":"- Check the installed Live Composer plugin version in the WordPress admin Plugins screen; versions below `2.1.24` are affected.\n- Confirm whether the site runs multisite or restricts `unfiltered_html`, since that is where the sources say the flaw matters.","fix":"- Live Composer plugin: move to `2.1.24` or later.","status":"open","published_at":"2026-11-11T06:17:10+00:00","first_seen_at":"2026-11-11T06:25:39+00:00","triaged_at":"2026-11-11T06:28:06+00:00","updated_at":"2026-11-11T06:28:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:28:06Z","model":"claude-haiku-5-5","output":{"fix":"- Live Composer plugin: move to `2.1.24` or later.","reach":"network","title":"Live Composer WordPress plugin: staff settings allow stored cross-site scripting","impact":"medium","summary":"The Live Composer WordPress plugin before 2.1.24 does not sanitise or escape some staff member settings before printing them on pages. An administrator can store script that runs in other users' browsers, even where the unfiltered_html capability is disabled, such as multisite setups.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","live-composer","multisite"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Stored script runs in visitors' and other admins' browsers","analyst_note":"","how_to_check":"- Check the installed Live Composer plugin version in the WordPress admin Plugins screen; versions below `2.1.24` are affected.\n- Confirm whether the site runs multisite or restricts `unfiltered_html`, since that is where the sources say the flaw matters.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-2.1.24-or-later","no-admin-accounts-untrusted"],"who_is_affected":"Sites running the Live Composer WordPress plugin before version 2.1.24, particularly multisite installations where administrators are not allowed unfiltered HTML. The attacker needs an administrator-level account, so sites that limit who holds admin rights face less risk. Sites already on 2.1.24 or later are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000749,"input_tokens":4558,"output_tokens":587,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-15712':15A,18A '-2025':14A,17A '2.1.24':31B,75C 'administr':47B,101C 'allow':7A,94C 'attack':109C 'browser':56B 'capabl':62B,115C 'compos':2A,21B,27B,71C 'could':93C 'cross':10A,106C 'cross-sit':9A,105C 'cve':13A,16A 'disabl':64B 'disallow':117C 'e.g':118C 'escap':36B,80C 'even':57B,110C 'high':96C 'high-privileg':95C 'html':61B,114C 'live':1A,20B,26B,70C 'live-compos':19B 'member':39B,85C 'multisit':22B,67B,120C 'output':88C 'packag':23B 'page':45B,91C 'perform':103C 'plugin':4A,29B,73C 'print':42B 'privileg':97C 'run':52B 'sanitis':34B,78C 'script':12A,50B,108C 'set':6A,40B,86C 'setup':68B,121C 'site':11A,107C 'staff':5A,38B,84C 'store':8A,49B,104C 'unfilt':60B,113C 'user':55B,98C 'wordpress':3A,24B,28B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Live Composer WordPress plugin before version 2.1.24, particularly multisite installations where administrators are not allowed unfiltered HTML. The attacker needs an administrator-level account, so sites that limit who holds admin rights face less risk. Sites already on 2.1.24 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["livecomposer","low","multisite","package","wordpress"],"campaign_type":null,"search_a":"'-15712':15A,18A '-2025':14A,17A 'allow':7A 'compos':2A 'cross':10A 'cross-sit':9A 'cve':13A,16A 'live':1A 'plugin':4A 'script':12A 'set':6A 'site':11A 'staff':5A 'store':8A 'wordpress':3A","search_b":"'2.1.24':31B 'administr':47B 'browser':56B 'capabl':62B 'compos':21B,27B 'disabl':64B 'escap':36B 'even':57B 'html':61B 'live':20B,26B 'live-compos':19B 'member':39B 'multisit':22B,67B 'packag':23B 'page':45B 'plugin':29B 'print':42B 'run':52B 'sanitis':34B 'script':50B 'set':40B 'setup':68B 'staff':38B 'store':49B 'unfilt':60B 'user':55B 'wordpress':24B,28B","search_c":"'2.1.24':75C 'administr':101C 'allow':94C 'attack':109C 'capabl':115C 'compos':71C 'could':93C 'cross':106C 'cross-sit':105C 'disallow':117C 'e.g':118C 'escap':80C 'even':110C 'high':96C 'high-privileg':95C 'html':114C 'live':70C 'member':85C 'multisit':120C 'output':88C 'page':91C 'perform':103C 'plugin':73C 'privileg':97C 'sanitis':78C 'script':108C 'set':86C 'setup':121C 'site':107C 'staff':84C 'store':104C 'unfilt':113C 'user':98C 'wordpress':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-15712","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15712","severity":null,"published_at":"2026-11-11T06:17:10+00:00","modified_at":"2026-11-11T06:17:10+00:00","first_seen_at":"2026-11-11T06:25:39+00:00","fetched_at":"2026-11-11T06:25:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}