CVE-2025-71453: vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList
vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Logged-in vtenext users are the targets. An attacker can induce such a user to submit a crafted POST request, after which JavaScript executes in that user’s vtenext session.
What does an attacker need to exploit this issue?
The attacker does not need authentication according to the supplied vector, but does need user interaction: a logged-in victim must submit a crafted POST request. The request supplies HTML in widgetId keys within the widgetInfoList JSON parameter.
Which versions are affected?
vtenext versions before 25.02.2 are affected. The provided release-note reference identifies 25.02.2 as the relevant fixed release.