CVE-2025-68598

MediumCVSS 6.5

Published: 24/12/2025(UTC)Updated: 21/09/2026(UTC)Translated: 21/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer (live-composer-page-builder) allows Stored XSS. This issue affects Page Builder: Live Composer from n/a through 2.1.22.

Risk Assessment

A malicious script could be persistently stored and executed in the user's browser, potentially leading to session hijacking or data theft.

Recommendation

Update Page Builder: Live Composer to a version later than 2.1.22.

Other vulnerabilities in Page Builder: Live Composer

CVE-2024-35768Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer (live-composer-page-builder) allows DOM-Based XSS. This issue affects Page Builder: Live Composer from n/a through 2.1.22.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 2.1.22.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS