Microweber Has Stored XSS Vulnerability in User Profile Fields

HIGH 7.6CVE-2025-51503 · GHSA-782f-gxj5-xvqc · Published 31/07/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
microweber/microweber Packagist	`≥ 2.0.0, ≤ 2.0.19`	No fix yet
microweber microweber	`= 2.0.0`	No fix yet

Description

A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-51503 · ADVISORY
microweber/microweber · PACKAGE
progprnv/CVE-Reports · WEB
progprnv/CVE-Reports · WEB
progprnv/CVE-Reports · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free