CVE-2025-10758: htmly Custom Field post cross site scripting
A security vulnerability has been detected in htmly up to 3.1.0. The impacted element is an unknown function of the file /htmly/admin/field/post of the component Custom Field Handler. Such manipulation of the argument label leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10758?
CVE-2025-10758 has been classified as a high-severity vulnerability due to its potential for cross-site scripting attacks.
How can I fix CVE-2025-10758?
To remediate CVE-2025-10758, upgrade Htmly to version 3.1.1 or later, which contains the necessary security patches.
What types of attacks are possible with CVE-2025-10758?
CVE-2025-10758 allows attackers to execute cross-site scripting (XSS) attacks by manipulating the argument label within the Custom Field Handler.
Which versions of Htmly are affected by CVE-2025-10758?
CVE-2025-10758 affects Htmly versions up to and including 3.1.0.
What component is vulnerable in CVE-2025-10758?
The vulnerable component in CVE-2025-10758 is the Custom Field Handler located in the /htmly/admin/field/post file.