CVE-2025-15708: Live Composer < 2.1.23 - Admin+ Stored XSS via Partner Slug

Q: Which deployments are most meaningfully exposed?

Deployments where high-privilege users can change Live Composer custom post type slug settings are exposed. Multisite installations are specifically relevant because the issue can be exploited even when the unfiltered_html capability is disallowed.

Q: What access does an attacker need?

An attacker needs high-privilege access, such as administrator-level access, to configure the affected custom post type slug settings. The available information does not indicate exploitation by unauthenticated or low-privilege users.

Q: How can teams identify affected installations?

Check whether the Live Composer plugin version is earlier than 2.1.23. Also review custom post type slug settings for unexpected markup or script-like content, as those values may be used in front-end links.

Published Nov 7, 2026

Updated

The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in a multisite setup).

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Which deployments are most meaningfully exposed?

Deployments where high-privilege users can change Live Composer custom post type slug settings are exposed. Multisite installations are specifically relevant because the issue can be exploited even when the unfiltered_html capability is disallowed.

What access does an attacker need?

An attacker needs high-privilege access, such as administrator-level access, to configure the affected custom post type slug settings. The available information does not indicate exploitation by unauthenticated or low-privilege users.

How can teams identify affected installations?

Check whether the Live Composer plugin version is earlier than 2.1.23. Also review custom post type slug settings for unexpected markup or script-like content, as those values may be used in front-end links.

CVE-2025-15708: Live Composer < 2.1.23 - Admin+ Stored XSS via Partner Slug

Event History

Frequently Asked Questions

Which deployments are most meaningfully exposed?

What access does an attacker need?

How can teams identify affected installations?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most meaningfully exposed?

What access does an attacker need?

How can teams identify affected installations?