CVE-2025-63645: XSS

Published Nov 12, 2025

Updated

A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the application's message system. Unsanitized message content submitted by one user is persisted by the server and later rendered in another user's Inbox view without appropriate context-aware encoding. As a result, attacker-controlled content executes in the recipient's browser context when the Inbox message is viewed.

Affected Software

2 affected components

pH7Software pH7-Social-Dating-CMS

Ph7builder Ph7 Social Dating Builder=17.9.1

Event History

Nov 12, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker needs low-level authenticated access (PR:L) to submit a malicious message through the application's message system. No complex attack conditions are indicated (AC:L).

Who is exposed to the malicious content?

Users are exposed when they view an attacker-controlled message in their Inbox. The payload executes in the recipient's browser context, so recipients of messages from a malicious authenticated user are the primary affected population.

Does exploitation require recipient interaction?

Yes. The recipient must view the stored message in the Inbox for the attacker-controlled content to execute, as reflected by the UI:R vector.

CVE-2025-63645: XSS

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Who is exposed to the malicious content?

Does exploitation require recipient interaction?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Who is exposed to the malicious content?

Does exploitation require recipient interaction?