{"affected":[{"defaultStatus":"unaffected","product":"Live Composer","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2025-15712","cwes":["CWE-79"],"description":"The Live Composer  WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in pages, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups).","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/00d2c75d-7e8f-4f6c-8b72-c66b1bb6cc59/"}],"kev":null,"metrics":[],"modifiedAt":1794376804765,"publishedAt":1794376804765,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/00d2c75d-7e8f-4f6c-8b72-c66b1bb6cc59/"}],"remediation":[],"revision":"460651f98c97c6bc18caa327c36ee37f849526e6342ffc215dc0c1499e120d30","sources":[{"modifiedAt":1794376804765,"name":"CNA: WPScan","retrievedAt":1794377300141,"url":"https://www.cve.org/CVERecord?id=CVE-2025-15712"}],"ssvc":null,"status":"published","title":"Live Composer < 2.1.24 - Admin+ Stored XSS via Staff","updatedAt":1794377300141}