CVE-2021-25978

—

CVSS 3.1

5.4 medium

EPSS

<1%p41

Published

Nov 7, 2021 (Nov 7, 2021)

Modified

Jun 17, 2026

Description

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.

Vendors: apostrophecms
Products: apostrophecms
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.