CVE-2025-30342: XSS
First published: Fri Mar 21 2025(Updated: )
An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly encoded when reflected; however, adding attributes to links is possible, which allows the injection of JavaScript via the onmouseover attribute and others. When a user moves the mouse over such a prepared link, JavaScript is executed in that user's session.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenSlides | <4.2.5 | |
| OpenSlides | <4.2.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-30342?
CVE-2025-30342 is classified as a moderate severity Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2025-30342?
To fix CVE-2025-30342, upgrade OpenSlides to version 4.2.5 or later.
What is the impact of CVE-2025-30342 on OpenSlides?
CVE-2025-30342 can allow attackers to execute arbitrary JavaScript in the context of a user's session via the affected text submission fields.
Which versions of OpenSlides are affected by CVE-2025-30342?
CVE-2025-30342 affects OpenSlides versions prior to 4.2.5.
Is there a workaround for CVE-2025-30342 if I cannot upgrade?
There are no effective workarounds for CVE-2025-30342 other than upgrading to a fixed version.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/openslides
- canonical/openslides