CVE-2025-13537 is a stored Cross-Site Scripting vulnerability in the Live Composer – Free WordPress Website Builder plugin for WordPress, affecting all versions up to and including 2.0.2. The issue arises from improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied attributes. This allows authenticated attackers with Contributor-level privileges or higher to inject arbitrary web scripts into pages. These scripts execute in the context of users who access the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a medium impact on confidentiality and integrity but no impact on availability.

The vulnerability enables authenticated users with Contributor-level access or above to perform stored XSS attacks by injecting malicious scripts into pages. When other users view these pages, the scripts execute in their browsers, potentially compromising user data confidentiality and integrity. There is no indication of availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. In the meantime, restricting Contributor-level user privileges or disabling the affected plugin may reduce risk.