{"affected":[{"defaultStatus":"unaffected","product":"Live Composer","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.1.23","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2025-15708","cwes":["CWE-79"],"description":"The Live Composer  WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/44369f11-99b5-4745-8e6b-aa705c3f8ce5/"}],"kev":null,"metrics":[],"modifiedAt":1794031224639,"publishedAt":1794031224639,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/44369f11-99b5-4745-8e6b-aa705c3f8ce5/"}],"remediation":[],"revision":"5c14c2196258927eecbb274e0bce83f23d3f5a865077d97b22b9b96cc281926f","sources":[{"modifiedAt":1794031224639,"name":"CNA: WPScan","retrievedAt":1794031707414,"url":"https://www.cve.org/CVERecord?id=CVE-2025-15708"}],"ssvc":null,"status":"published","title":"Live Composer < 2.1.23 - Admin+ Stored XSS via Partner Slug","updatedAt":1794031707414}