---
id: "CVE-2025-15713"
page: "https://infrastack.ai/live/CVE-2025-15713"
kind: "vulnerability"
aliases: ["CVE-2025-15713"]
title: "WordPress Live Composer plugin: stored script injection by page builder users"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["live-composer", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-builder-access-for-untrusted-users", "plugin-absent", "version-2.1.24-or-later"]
published_at: "2026-11-11T06:17:10+00:00"
first_seen_at: "2026-11-11T06:25:39+00:00"
updated_at: "2026-11-11T06:28:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15713", "first_seen_at": "2026-11-11T06:25:39+00:00"}]
exploit_sources: []
---

# WordPress Live Composer plugin: stored script injection by page builder users

Link for people: https://infrastack.ai/live/CVE-2025-15713 (this .md is for agents)

The Live Composer WordPress plugin before 2.1.24 does not sanitise or escape some page-builder module settings before printing them. A user with builder access can store JavaScript that runs in the browser of every visitor to the affected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Live Composer plugin version in the WordPress admin under Plugins; versions below `2.1.24` are affected.
- Look for the plugin folder (live-composer-page-builder) on sites you run.

## Fix

- Live Composer plugin: `2.1.24` or later (per the sources' stated fixed version)

## Timeline

- 2026-11-11T06:25:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-15713

## From the sources

The Live Composer  WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes when the affected page is viewed by any visitor; this has impact even on administrators where the unfiltered_html capability is disallowed, e.g. in multisite setups.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_