CVEvulnerability

CVE-2025-60869

7.3 HIGH Published 2025-10-10 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-10-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-79

Description

Publii CMS v0.46.5 (build 17089) allows persistent Cross-Site Scripting (XSS) via unsanitized input in configuration fields such as "Site Description" and "Footer Follow Buttons". An attacker can inject arbitrary JavaScript, which is stored in the project and executed in the browsers of remote visitors viewing the generated static site.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References