{"id":"CVE-2025-15714","kind":"vulnerability","aliases":["CVE-2025-15714"],"related":[],"title":"Live Composer WordPress plugin: Button settings allow stored cross-site scripting","description":"The Live Composer  WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on the front end, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups).","summary":"The Live Composer WordPress plugin before 2.1.24 does not sanitise or escape some Button module settings before showing them on the front end. An administrator can store script in those settings that runs in other users' browsers, even where unfiltered_html is disabled, such as multisite.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Live Composer","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["live-composer","multisite","package","wordpress"],"not_affected_if":["plugin-not-installed","version-2.1.24-or-later"],"how_to_check":"- Check the installed Live Composer plugin version in the WordPress admin under Plugins; affected if below `2.1.24`.\n- Check whether the site is a multisite install where administrators lack the unfiltered_html capability.","fix":"- Live Composer plugin: upgrade to `2.1.24` or later.","status":"open","published_at":"2026-11-11T06:17:10+00:00","first_seen_at":"2026-11-11T06:25:39+00:00","triaged_at":"2026-11-11T06:28:05+00:00","updated_at":"2026-11-11T06:28:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:28:05Z","model":"claude-haiku-5-5","output":{"fix":"- Live Composer plugin: upgrade to `2.1.24` or later.","reach":"internet","title":"Live Composer WordPress plugin: Button settings allow stored cross-site scripting","impact":"medium","summary":"The Live Composer WordPress plugin before 2.1.24 does not sanitise or escape some Button module settings before showing them on the front end. An administrator can store script in those settings that runs in other users' browsers, even where unfiltered_html is disabled, such as multisite.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","live-composer","multisite"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs script in other users' browsers via stored content.","analyst_note":"","how_to_check":"- Check the installed Live Composer plugin version in the WordPress admin under Plugins; affected if below `2.1.24`.\n- Check whether the site is a multisite install where administrators lack the unfiltered_html capability.","plain_action":"","product_name":"Live Composer","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-2.1.24-or-later"],"who_is_affected":"Sites running the Live Composer WordPress plugin before 2.1.24, particularly multisite setups where administrators lack unfiltered_html. Exploitation requires an account with high privileges, so sites with only trusted administrators carry lower risk. Sites without the plugin or already on 2.1.24 or later are not affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000744,"input_tokens":4559,"output_tokens":577,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-15714':15A,18A '-2025':14A,17A '2.1.24':33B,79C 'administr':51B,107C 'allow':7A,100C 'attack':115C 'browser':63B 'button':5A,40B,88C 'capabl':121C 'compos':2A,23B,29B,75C 'composer':20A 'could':99C 'cross':10A,112C 'cross-sit':9A,111C 'cve':13A,16A 'disabl':69B 'disallow':123C 'e.g':124C 'end':49B,97C 'escap':38B,84C 'even':64B,116C 'front':48B,96C 'high':102C 'high-privileg':101C 'html':67B,120C 'live':1A,19A,22B,28B,74C 'live-compos':21B 'modul':41B,89C 'multisit':24B,72B,126C 'output':92C 'packag':25B 'perform':109C 'plugin':4A,31B,77C 'privileg':103C 'run':59B 'sanitis':36B,82C 'script':12A,54B,114C 'set':6A,42B,57B,90C 'setup':127C 'show':44B 'site':11A,113C 'store':8A,53B,110C 'unfilt':66B,119C 'user':62B,104C 'wordpress':3A,26B,30B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Live Composer WordPress plugin before 2.1.24, particularly multisite setups where administrators lack unfiltered_html. Exploitation requires an account with high privileges, so sites with only trusted administrators carry lower risk. Sites without the plugin or already on 2.1.24 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["composer","livecomposer"],"ptokens":["composer","live"],"labels":["livecomposer","low","multisite","package","vendor","wordpress"],"campaign_type":null,"search_a":"'-15714':15A,18A '-2025':14A,17A 'allow':7A 'button':5A 'compos':2A 'composer':20A 'cross':10A 'cross-sit':9A 'cve':13A,16A 'live':1A,19A 'plugin':4A 'script':12A 'set':6A 'site':11A 'store':8A 'wordpress':3A","search_b":"'2.1.24':33B 'administr':51B 'browser':63B 'button':40B 'compos':23B,29B 'disabl':69B 'end':49B 'escap':38B 'even':64B 'front':48B 'html':67B 'live':22B,28B 'live-compos':21B 'modul':41B 'multisit':24B,72B 'packag':25B 'plugin':31B 'run':59B 'sanitis':36B 'script':54B 'set':42B,57B 'show':44B 'store':53B 'unfilt':66B 'user':62B 'wordpress':26B,30B","search_c":"'2.1.24':79C 'administr':107C 'allow':100C 'attack':115C 'button':88C 'capabl':121C 'compos':75C 'could':99C 'cross':112C 'cross-sit':111C 'disallow':123C 'e.g':124C 'end':97C 'escap':84C 'even':116C 'front':96C 'high':102C 'high-privileg':101C 'html':120C 'live':74C 'modul':89C 'multisit':126C 'output':92C 'perform':109C 'plugin':77C 'privileg':103C 'sanitis':82C 'script':114C 'set':90C 'setup':127C 'site':113C 'store':110C 'unfilt':119C 'user':104C 'wordpress':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-15714","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15714","severity":null,"published_at":"2026-11-11T06:17:10+00:00","modified_at":"2026-11-11T06:17:10+00:00","first_seen_at":"2026-11-11T06:25:39+00:00","fetched_at":"2026-11-11T06:25:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}