{"affected":[{"defaultStatus":"unaffected","product":"Live Composer","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2025-15711","cwes":["CWE-79"],"description":"The Live Composer  WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups).","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/3c296d09-122f-420e-9ab1-81ffdfff88c2/"}],"kev":null,"metrics":[],"modifiedAt":1794376804589,"publishedAt":1794376804589,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/3c296d09-122f-420e-9ab1-81ffdfff88c2/"}],"remediation":[],"revision":"0fd2601277f53b407e6961e2f843c9421c4cdd03153effd5fe6b93374abf40f1","sources":[{"modifiedAt":1794376804589,"name":"CNA: WPScan","retrievedAt":1794377298563,"url":"https://www.cve.org/CVERecord?id=CVE-2025-15711"}],"ssvc":null,"status":"published","title":"Live Composer < 2.1.24 - Admin+ Stored XSS via Social","updatedAt":1794377298563}