{"id":"CVE-2025-15713","kind":"vulnerability","aliases":["CVE-2025-15713"],"related":[],"title":"WordPress Live Composer plugin: stored script injection by page builder users","description":"The Live Composer  WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes when the affected page is viewed by any visitor; this has impact even on administrators where the unfiltered_html capability is disallowed, e.g. in multisite setups.","summary":"The Live Composer WordPress plugin before 2.1.24 does not sanitise or escape some page-builder module settings before printing them. A user with builder access can store JavaScript that runs in the browser of every visitor to the affected page.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["live-composer","package","self-hosted","wordpress"],"not_affected_if":["no-builder-access-for-untrusted-users","plugin-absent","version-2.1.24-or-later"],"how_to_check":"- Check the installed Live Composer plugin version in the WordPress admin under Plugins; versions below `2.1.24` are affected.\n- Look for the plugin folder (live-composer-page-builder) on sites you run.","fix":"- Live Composer plugin: `2.1.24` or later (per the sources' stated fixed version)","status":"open","published_at":"2026-11-11T06:17:10+00:00","first_seen_at":"2026-11-11T06:25:39+00:00","triaged_at":"2026-11-11T06:28:06+00:00","updated_at":"2026-11-11T06:28:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:28:06Z","model":"claude-haiku-5-5","output":{"fix":"- Live Composer plugin: `2.1.24` or later (per the sources' stated fixed version)","reach":"network","title":"WordPress Live Composer plugin: stored script injection by page builder users","impact":"medium","summary":"The Live Composer WordPress plugin before 2.1.24 does not sanitise or escape some page-builder module settings before printing them. A user with builder access can store JavaScript that runs in the browser of every visitor to the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","live-composer","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Visitors' browsers run attacker script on the affected site.","analyst_note":"Product ranges and the fixed version come from the advisory text only; the fix line should be confirmed against the plugin's own changelog.}","how_to_check":"- Check the installed Live Composer plugin version in the WordPress admin under Plugins; versions below `2.1.24` are affected.\n- Look for the plugin folder (live-composer-page-builder) on sites you run.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-absent","version-2.1.24-or-later","no-builder-access-for-untrusted-users"],"who_is_affected":"Sites running the Live Composer WordPress plugin before 2.1.24 that let users edit pages with its builder. The risk is highest where editors are not fully trusted or on multisite, where even administrators are exposed because unfiltered_html is restricted. Sites without this plugin, or already on 2.1.24 or later, are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000759,"input_tokens":4580,"output_tokens":602,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-15713':14A,17A '-2025':13A,16A '2.1.24':32B,73C 'access':51B,93C 'administr':97C,120C 'affect':65B,108C 'allow':90C 'arbitrari':102C 'browser':59B 'builder':10A,41B,50B,84C,96C 'capabl':125C 'compos':3A,20B,28B,69C 'cve':12A,15A 'default':99C 'disallow':127C 'e.g':128C 'escap':37B,78C 'even':118C 'everi':61B 'execut':105C 'host':24B 'html':124C 'impact':117C 'inject':7A,101C 'javascript':54B,103C 'live':2A,19B,27B,68C 'live-compos':18B 'modul':42B,85C 'multisit':130C 'output':88C 'packag':21B 'page':9A,40B,66B,83C,109C 'page-build':39B,82C 'plugin':4A,30B,71C 'print':45B 'run':56B 'sanitis':35B,76C 'script':6A 'self':23B 'self-host':22B 'set':43B,86C 'setup':131C 'store':5A,53B 'unfilt':123C 'user':11A,48B,91C 'view':111C 'visitor':62B,114C 'wordpress':1A,25B,29B,70C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Live Composer WordPress plugin before 2.1.24 that let users edit pages with its builder. The risk is highest where editors are not fully trusted or on multisite, where even administrators are exposed because unfiltered_html is restricted. Sites without this plugin, or already on 2.1.24 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["livecomposer","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-15713':14A,17A '-2025':13A,16A 'builder':10A 'compos':3A 'cve':12A,15A 'inject':7A 'live':2A 'page':9A 'plugin':4A 'script':6A 'store':5A 'user':11A 'wordpress':1A","search_b":"'2.1.24':32B 'access':51B 'affect':65B 'browser':59B 'builder':41B,50B 'compos':20B,28B 'escap':37B 'everi':61B 'host':24B 'javascript':54B 'live':19B,27B 'live-compos':18B 'modul':42B 'packag':21B 'page':40B,66B 'page-build':39B 'plugin':30B 'print':45B 'run':56B 'sanitis':35B 'self':23B 'self-host':22B 'set':43B 'store':53B 'user':48B 'visitor':62B 'wordpress':25B,29B","search_c":"'2.1.24':73C 'access':93C 'administr':97C,120C 'affect':108C 'allow':90C 'arbitrari':102C 'builder':84C,96C 'capabl':125C 'compos':69C 'default':99C 'disallow':127C 'e.g':128C 'escap':78C 'even':118C 'execut':105C 'html':124C 'impact':117C 'inject':101C 'javascript':103C 'live':68C 'modul':85C 'multisit':130C 'output':88C 'page':83C,109C 'page-build':82C 'plugin':71C 'sanitis':76C 'set':86C 'setup':131C 'unfilt':123C 'user':91C 'view':111C 'visitor':114C 'wordpress':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-15713","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15713","severity":null,"published_at":"2026-11-11T06:17:10+00:00","modified_at":"2026-11-11T06:17:10+00:00","first_seen_at":"2026-11-11T06:25:39+00:00","fetched_at":"2026-11-11T06:25:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}