{"id":"CVE-2025-15714","published":"2026-11-11T06:17:10.293","lastModified":"2026-11-11T06:17:10.293","description":"The Live Composer  WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on the front end, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups).","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/03a1c844-9a9f-4702-ba6c-3ada3e779014/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}