CVE-2025-66522: Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Digital IDs Common Name Field
A stored cross-site scripting (XSS) vulnerability exists in the Digital IDs functionality of the Foxit PDF Editor Cloud (pdfonline.foxit.com). The application does not properly sanitize or encode the Common Name field of Digital IDs before inserting user-supplied content into the DOM. As a result, embedded HTML or JavaScript may execute whenever the Digital IDs dialog is accessed or when the affected PDF is loaded.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66522?
CVE-2025-66522 has a high severity rating due to its potential to allow attackers to execute arbitrary scripts in the context of a user's browser.
How do I fix CVE-2025-66522?
To fix CVE-2025-66522, update to the latest version of Foxit PDF Editor Cloud that addresses the stored cross-site scripting vulnerability.
What impacts does CVE-2025-66522 have on Foxit PDF Editor Cloud?
CVE-2025-66522 allows attackers to inject malicious scripts into the application, compromising user data and session security.
Who is affected by CVE-2025-66522?
Any user of the Foxit PDF Editor Cloud who utilizes the Digital IDs functionality may be affected by CVE-2025-66522.
Are there any workarounds for CVE-2025-66522?
Currently, the best workaround for CVE-2025-66522 is to restrict or avoid using the Digital IDs feature until a patch is applied.