CVE-2025-15713: vulnerability in Live Composer
Live Composer < 2.1.24 - Admin+ Stored XSS via Icon
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
0Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Track
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes when the affected page is viewed by any visitor; this has impact even on administrators where the unfiltered_html capability is disallowed, e.g. in multisite setups.
Affected products
Unknown · Live ComposerRelated CVEs — Live Composer
In the same product, most dangerous first.
CVE-2026-119073MEDIUMLive Composer < 2.1.23 - Contributor+ Stored XSS via Post Module PaginationEPSS 0.3%CVE-2025-15708LOWLive Composer < 2.1.23 - Admin+ Stored XSS via Partner SlugEPSS 0.2%CVE-2026-119531—Live Composer < 2.1.24 - Contributor+ Stored XSS via Module Area ShortcodeEPSS —CVE-2025-15714—Live Composer < 2.1.24 - Admin+ Stored XSS via ButtonEPSS —CVE-2025-15712—Live Composer < 2.1.24 - Admin+ Stored XSS via StaffEPSS —CVE-2025-15711—Live Composer < 2.1.24 - Admin+ Stored XSS via SocialEPSS —