CVE-2025-60869

Publii CMS v0.46.5 (build 17089) allows persistent Cross-Site Scripting (XSS) via unsanitized input in configuration fields such as "Site Description" and…

High · published October 10, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

Publii CMS v0.46.5 (build 17089) allows persistent Cross-Site Scripting (XSS) via unsanitized input in configuration fields such as "Site Description" and "Footer Follow Buttons". An attacker can inject arbitrary JavaScript, which is stored in the project and executed in the browsers of remote visitors viewing the generated static site.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:U/UI:R
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.2th percentile
Published
2025-10-10T00:00Z
EPSS history
Timeline
  • 10 OCT 00:00Z
    Publii CMS v0.46.5 (build 17089) allows persistent Cross-Site Scripting (XSS) via unsanitized input in configuration fields such as "Site Description" and…
    cvelistv5