CVE-2025-15714: Live Composer < 2.1.24 - Admin+ Stored XSS via Button

Q: Which deployments are most relevant to this issue?

The issue is particularly relevant to WordPress multisite deployments where administrators may have the unfiltered_html capability disallowed. It affects Live Composer versions before 2.1.24.

Q: What level of access is required to exploit it?

An attacker needs high-privilege access, such as an administrator account, and must be able to configure affected Live Composer Button module settings. The issue can be exploited even when unfiltered_html is disallowed.

Q: What is the remediation?

Update the Live Composer WordPress plugin to version 2.1.24 or later. The affected versions are those before 2.1.24.

Published Nov 11, 2026

Updated

The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on the front end, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (e.g. in multisite setups).

Affected Software

1 affected component

Live Composer Live Composer WordPress plugin<2.1.24

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which deployments are most relevant to this issue?

The issue is particularly relevant to WordPress multisite deployments where administrators may have the unfiltered_html capability disallowed. It affects Live Composer versions before 2.1.24.

What level of access is required to exploit it?

An attacker needs high-privilege access, such as an administrator account, and must be able to configure affected Live Composer Button module settings. The issue can be exploited even when unfiltered_html is disallowed.

What is the remediation?

Update the Live Composer WordPress plugin to version 2.1.24 or later. The affected versions are those before 2.1.24.

CVE-2025-15714: Live Composer < 2.1.24 - Admin+ Stored XSS via Button

Affected Software

Event History

Frequently Asked Questions

Which deployments are most relevant to this issue?

What level of access is required to exploit it?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most relevant to this issue?

What level of access is required to exploit it?

What is the remediation?