CVE-2025-69241CWE-79

Stored XSS in Raytha CMS

Medium · published March 16, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
15.0
In the wild
Unconfirmed
What it is

Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page.

This issue was fixed in version 1.4.6.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00247 · 15.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-16T11:53Z
EPSS history
Timeline
  • 16 MAR 11:53Z
    Stored XSS in Raytha CMS
    cvelistv5