{"affected":[{"defaultStatus":"unaffected","product":"Live Composer","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2025-15714","cwes":["CWE-79"],"description":"The Live Composer  WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on the front end, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups).","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/03a1c844-9a9f-4702-ba6c-3ada3e779014/"}],"kev":null,"metrics":[],"modifiedAt":1794376805113,"publishedAt":1794376805113,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/03a1c844-9a9f-4702-ba6c-3ada3e779014/"}],"remediation":[],"revision":"92c0cee469600ff39541260a599cdb5cf2c9cc2581329e90ce700b21b7939966","sources":[{"modifiedAt":1794376805113,"name":"CNA: WPScan","retrievedAt":1794377302386,"url":"https://www.cve.org/CVERecord?id=CVE-2025-15714"}],"ssvc":null,"status":"published","title":"Live Composer < 2.1.24 - Admin+ Stored XSS via Button","updatedAt":1794377302386}