CVE-2025-15713

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15713", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-10-30T09:54:09.885Z", "datePublished": "2026-11-11T06:00:04.940Z", "dateUpdated": "2026-11-11T11:46:03.959Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-11-11T06:00:04.940Z"}, "title": "Live Composer < 2.1.24 - Admin+ Stored XSS via Icon", "problemTypes": [{"descriptions": [{"description": "CWE-79 Cross-Site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Live Composer", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "2.1.24"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes when the affected page is viewed by any visitor; this has impact even on administrators where the unfiltered_html capability is disallowed, e.g. in multisite setups."}], "references": [{"url": "https://wpscan.com/vulnerability/eb5d2c5b-0035-4c84-876a-b4268e27e3cc/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Krugov Artyom", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-11T11:28:04.856633Z", "id": "CVE-2025-15713", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-11T11:46:03.959Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15713", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-10-30T09:54:09.885Z", "datePublished": "2026-11-11T06:00:04.940Z", "dateUpdated": "2026-11-11T11:46:03.959Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-11-11T06:00:04.940Z"}, "title": "Live Composer < 2.1.24 - Admin+ Stored XSS via Icon", "problemTypes": [{"descriptions": [{"description": "CWE-79 Cross-Site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Live Composer", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "2.1.24"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes when the affected page is viewed by any visitor; this has impact even on administrators where the unfiltered_html capability is disallowed, e.g. in multisite setups."}], "references": [{"url": "https://wpscan.com/vulnerability/eb5d2c5b-0035-4c84-876a-b4268e27e3cc/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Krugov Artyom", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-15713", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-11T11:28:04.856633Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-11T11:25:29.188Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Live Composer", "vendor": "Unknown", "versions": [{"lessThan": "2.1.24", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes when the affected page is viewed by any visitor; this has impact even on administrators where the unfiltered_html capability is disallowed, e.g. in multisite setups."}, {"lang": "es", "value": "La extensi\u00f3n Live Composer de WordPress, antes de la versi\u00f3n 2.1.24, no sanitiza ni evita la escapada de algunos de sus configuraciones del m\u00f3dulo de edici\u00f3n de p\u00e1gina antes de mostrarlas, lo que permite a los usuarios con acceso al editor (de forma predeterminada, el Administrador) inyectar c\u00f3digo JavaScript arbitrario que se ejecuta cuando la p\u00e1gina afectada se ve por cualquier visitante; este impacto a\u00fan afecta incluso a los administradores donde la capacidad de unificaci\u00f3n de HTML no est\u00e1 deshabilitada, por ejemplo, en configuraciones de multisite.\n\nNota: He utilizado la palabra \u201cextensi\u00f3n\u201d para traducir \u201cplugin\u201d, como es com\u00fan en espa\u00f1ol. Si prefieres utilizar \u201cmodo de WordPress\u201d, puedo hacer la traducci\u00f3n."}], "id": "CVE-2025-15713", "lastModified": "2026-11-13T20:10:00.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15713", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-11T11:28:04.856633Z", "version": "2.0.3"}}]}, "published": "2026-11-11T06:17:10.167", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/eb5d2c5b-0035-4c84-876a-b4268e27e3cc/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.24)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}]}, "original": {"product": "Live Composer", "source": "cna", "vendor": "Unknown"}, "product": "live_composer", "vendor": "wordpress-extensions"}], "created": "2026-11-11T12:00:23.244937+00:00", "updated": "2026-11-13T00:15:11.711897+00:00", "vendors": ["wordpress-extensions", "wordpress-extensions$PRODUCT$live_composer"]}