CVE-2025-15712: vulnerability in Live Composer
Live Composer < 2.1.24 - Admin+ Stored XSS via Staff
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
0Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Track
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in pages, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups).
Affected products
Unknown · Live ComposerRelated CVEs — Live Composer
In the same product, most dangerous first.
CVE-2026-119073MEDIUMLive Composer < 2.1.23 - Contributor+ Stored XSS via Post Module PaginationEPSS 0.3%CVE-2025-15708LOWLive Composer < 2.1.23 - Admin+ Stored XSS via Partner SlugEPSS 0.2%CVE-2026-119531—Live Composer < 2.1.24 - Contributor+ Stored XSS via Module Area ShortcodeEPSS —CVE-2025-15714—Live Composer < 2.1.24 - Admin+ Stored XSS via ButtonEPSS —CVE-2025-15713—Live Composer < 2.1.24 - Admin+ Stored XSS via IconEPSS —CVE-2025-15711—Live Composer < 2.1.24 - Admin+ Stored XSS via SocialEPSS —