Microweber XSS Vulnerability in the homepage Endpoint

HIGH 7.6CVE-2025-51504 · GHSA-2x2j-3c2v-g3c2 · Published 01/08/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
microweber/microweber Packagist	`≥ 2.0.0, ≤ 2.0.19`	No fix yet
microweber microweber	`= 2.0.0`	No fix yet

Description

Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS) in the /projects/profile, homepage endpoint via the last name field.

NVD description

Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.