Unrated severityNVD Advisory· Published Nov 11, 2026
CVE-2025-15714
CVE-2025-15714
Description
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on the front end, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.1.24
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.