CVE-2025-14071

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.2 via deserialization of untrusted input in the dslc_module_posts_output shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

• CWE-502

• https://github.com/live-composer/live-composer-page-builder/commit/2b0b430ab107eb6cb72196251e429a695c11e41b
• https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/1.5.53/modules/posts/module.php#L2807
• https://plugins.trac.wordpress.org/browser/live-composer-page-builder/trunk/modules/posts/module.php#L2807
• https://plugins.trac.wordpress.org/changeset/3419715/live-composer-page-builder/trunk/modules/posts/module.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4b15c991-5256-405c-8382-85dba6f032ba?source=cve
• https://github.com/live-composer/live-composer-page-builder/commit/17176e259878b450f9feaabbf42522b0e360ff96

Published

Dec 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14066Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-14067The Easy Form Builder plugin for WordPress is vulnerable to …5.3
• CVE-2025-14068The WPNakama plugin for WordPress is vulnerable to time-base…7.5
• CVE-2025-14069The Schema & Structured Data for WP & AMP plugin for WordPre…6.4
• CVE-2025-1407The AMO Team Showcase plugin for WordPress is vulnerable to …5.4
• CVE-2025-14070The Reviewify plugin for WordPress is vulnerable to unauthor…7.5
• CVE-2025-14072The Ninja Forms WordPress plugin before 3.13.3 allows unaut…5.3
• CVE-2025-14073The WooCommerce PayPal Payments plugin for WordPress is vuln…5.3
• CVE-2025-14074The PDF for Contact Form 7 + Drag and Drop Template Builder …4.3
• CVE-2025-14075The WP Hotel Booking plugin for WordPress is vulnerable to S…5.3
• CVE-2025-14076The iXML – Google XML sitemap generator plugin for WordPress…6.1
• CVE-2025-14077The Simcast plugin for WordPress is vulnerable to Cross-Site…4.3