CVE-2025-15713

The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder Administrator by default to inject arbitrary JavaScript that executes when the affected page is viewed by any...