CVE-2025-15712: Live Composer < 2.1.24 - Admin+ Stored XSS via Staff

Q: Who can exploit this issue?

A high-privilege WordPress user, such as an administrator, can exploit it through affected Live Composer staff member settings. It can still be exploited when the user's unfiltered_html capability is disabled, including in multisite environments.

Q: What configurations are particularly relevant?

WordPress multisite setups are specifically relevant because administrators may have unfiltered_html disallowed there. The issue affects Live Composer versions before 2.1.24.

Q: How can I tell whether my site may be affected?

Check whether Live Composer is installed at a version earlier than 2.1.24 and whether staff member settings have been edited by high-privilege users. Review rendered pages that use those settings for unexpected script or HTML content.

Published Nov 11, 2026

Updated

The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in pages, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (e.g. in multisite setups).

Affected Software

1 affected component

Live Composer Live Composer<2.1.24

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A high-privilege WordPress user, such as an administrator, can exploit it through affected Live Composer staff member settings. It can still be exploited when the user's unfiltered_html capability is disabled, including in multisite environments.

What configurations are particularly relevant?

WordPress multisite setups are specifically relevant because administrators may have unfiltered_html disallowed there. The issue affects Live Composer versions before 2.1.24.

How can I tell whether my site may be affected?

Check whether Live Composer is installed at a version earlier than 2.1.24 and whether staff member settings have been edited by high-privilege users. Review rendered pages that use those settings for unexpected script or HTML content.

CVE-2025-15712: Live Composer < 2.1.24 - Admin+ Stored XSS via Staff

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What configurations are particularly relevant?

How can I tell whether my site may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What configurations are particularly relevant?

How can I tell whether my site may be affected?