What is GHSA-q2pq-rwvm-qmrr?

GHSA-q2pq-rwvm-qmrr is a security advisory published by GitHub Security Advisories with Low severity. The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom...

Which CVE IDs does GHSA-q2pq-rwvm-qmrr cover?

GHSA-q2pq-rwvm-qmrr covers the following CVE IDs: CVE-2025-15708. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q2pq-rwvm-qmrr?

GHSA-q2pq-rwvm-qmrr has a CVSS v3 base score of 3.5, published by GitHub Security Advisories.

GHSA-q2pq-rwvm-qmrrLowCVSS 3.5

The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom...

Vendor

GitHub Security Advisories

Published

November 7, 2026

Last Modified

November 7, 2026

🔗 CVE IDs covered (1)

CVE-2025-15708 →

📋 Description

The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2025-15708
https://wpscan.com/vulnerability/44369f11-99b5-4745-8e6b-aa705c3f8ce5
https://github.com/advisories/GHSA-q2pq-rwvm-qmrr