CVE-2025-15711: Live Composer < 2.1.24 - Admin+ Stored XSS via Social

Q: Who can exploit this issue?

An attacker needs high-privilege access, such as an administrator account, and the ability to modify affected Live Composer module settings. The issue is specifically relevant even where that user does not have the unfiltered_html capability.

Q: Are WordPress multisite deployments affected?

Yes. Multisite setups are explicitly relevant because they may disallow unfiltered_html, but the vulnerable plugin versions can still permit stored cross-site scripting through affected module settings.

Q: What versions should be remediated?

Live Composer versions before 2.1.24 are affected. Update the plugin to version 2.1.24 or later.

Q: How can I determine whether content may already be affected?

Review Live Composer module settings created or edited by administrator-level users, particularly values that are rendered into href attributes. Look for unexpected script-like or malformed URL content in saved module configuration and published pages.

Published Nov 11, 2026

Updated

The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (e.g. in multisite setups).

Affected Software

1 affected component

Live Composer Live Composer<2.1.24

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An attacker needs high-privilege access, such as an administrator account, and the ability to modify affected Live Composer module settings. The issue is specifically relevant even where that user does not have the unfiltered_html capability.

Are WordPress multisite deployments affected?

Yes. Multisite setups are explicitly relevant because they may disallow unfiltered_html, but the vulnerable plugin versions can still permit stored cross-site scripting through affected module settings.

What versions should be remediated?

Live Composer versions before 2.1.24 are affected. Update the plugin to version 2.1.24 or later.

How can I determine whether content may already be affected?

Review Live Composer module settings created or edited by administrator-level users, particularly values that are rendered into href attributes. Look for unexpected script-like or malformed URL content in saved module configuration and published pages.

CVE-2025-15711: Live Composer < 2.1.24 - Admin+ Stored XSS via Social

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are WordPress multisite deployments affected?

What versions should be remediated?

How can I determine whether content may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are WordPress multisite deployments affected?

What versions should be remediated?

How can I determine whether content may already be affected?