{"id":"CVE-2025-15708","published":"2026-11-07T06:16:56.067","lastModified":"2026-11-10T16:28:46.510","description":"The Live Composer  WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).","cvssScore":3.5,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/44369f11-99b5-4745-8e6b-aa705c3f8ce5/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}