medium · CVSS v3 4.8

CVE-2025-15708

The Live Composer WordPress plugin prior to version 2.1.23 fails to sanitize custom post type slug settings, enabling stored XSS via front-e

Overview

The Live Composer WordPress plugin prior to version 2.1.23 fails to sanitize custom post type slug settings, enabling stored XSS via front-end links. Admin users can inject malicious scripts even when unfiltered_html is disabled. This flaw can compromise site integrity and user data.

Description

The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

Impact

Stored XSS allows attackers to inject scripts that run in the context of site visitors, potentially stealing cookies or session tokens. This can lead to credential theft, defacement, or unauthorized actions on behalf of users. Site administrators are at risk when they manage the plugin, and all site visitors may be impacted.

Remediation

Update Live Composer to 2.1.23 or later. If an update is not possible, disable or remove custom post type slug settings, or sanitize them before output. Additionally, revoke unfiltered_html capability for non-admin users and run a site-wide XSS scan.

Risk context

Medium severity (CVSS 4.8) indicates a moderate risk; while not critical, it warrants timely patching to prevent potential XSS exploitation.

Affected products

  • Live Composer WordPress plugin

Scores

Severity
medium
CVSS v2
3.5
CVSS v3
4.8
CVSS v4
—
EPSS
—

WordPress XSS Live Composer Stored XSS Plugin Vulnerability Front-end Admin

← All CVEs

Related CVEs

medium

CVE-2026-118528

The Directorist WordPress plugin (versions <8.11) fails to verify listing ownership before returning metadata via an AJAX action. This flaw lets any authenticated user with Subscriber or higher role read private and unpublished draft listings of other users. The exposed data includes contact information, potentially compromising user privacy.

View analysis

medium

CVE-2026-118204

The WP Data Access – App Builder plugin for WordPress is vulnerable to stored XSS via the ImageURL column value. Authenticated users with subscriber-level access can inject scripts that run when others view the page. This flaw allows malicious code to execute in the context of site visitors.

View analysis

medium

CVE-2026-121792

The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input_ . (Gravity Forms name-field part, or list-field row)' parameter in all versions up to, and including, 8.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a GamiPress achievement already configured against a Gravity Forms 'field value submission' event with the corresponding form published — a standard setup for sites using the integration.

View analysis

medium

CVE-2026-93902

The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is scoped to the attacker's own user meta but is exposed publicly on their author archive page at /author/ /, which is accessible to unauthenticated visitors regardless of whether the attacker has published any posts.

View analysis