CVE-2025-51684CWE-79cross-site-scripting

CVE-2025-51684

Medium · published July 31, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
16.9
In the wild
Unconfirmed
What it is

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of arbitrary JavaScript in the context of the hosting site.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00261 · 16.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-31T00:16Z
References (2)
https://github.com/CleverTap/clevertap-web-sdk/issues/416 · [email protected]https://github.com/CleverTap/clevertap-web-sdk/issues/416 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 JUL 00:00Z
    CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS)
    cvelistv5