CVE-2025-15713 · Package
NO FIX YET · SEE WHAT TO DO
The Live Composer WordPress plugin before 2.1.24 does not sanitise or escape some page-builder module settings before printing them. A user with builder access can store JavaScript that runs in the browser of every visitor to the affected page.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Live Composer WordPress plugin before 2.1.24 that let users edit pages with its builder. The risk is highest where editors are not fully trusted or on multisite, where even administrators are exposed because unfiltered_html is restricted. Sites without this plugin, or already on 2.1.24 or later, are not affected.
Not affected if no-builder-access-for-untrusted-users, plugin-absent, version-2.1.24-or-later
Who cares live-composer, self-hosted, wordpress
2.1.24 are affected.2.1.24 or later (per the sources' stated fixed version)The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes when the affected page is viewed by any visitor; this has impact even on administrators where the unfiltered_html capability is disallowed, e.g. in multisite setups.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.