Microweber has Reflected XSS Vulnerability in the id Parameter

MEDIUM 6.1CVE-2025-51501 · GHSA-8357-fjvx-xrm8 · Published 01/08/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
microweber/microweber Packagist	`≥ 2.0.0, ≤ 2.0.19`	No fix yet
microweber microweber	`= 2.0.0`	No fix yet

Description

Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.

NVD description

Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.

References

nvd.nist.gov/vuln/detail/CVE-2025-51501 · ADVISORY
microweber/microweber · PACKAGE
progprnv/CVE-Reports · WEB
progprnv/CVE-Reports · WEB
progprnv/CVE-Reports · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free