CVE-2025-52485: DNN.PLATFORM Stored XSS Vulnerability in Activity Feed
Summary
CVE-2025-52485: DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed. Affects DNN.PLATFORM versions >= 6.0.0, < 10.0.1. Fixed in 10.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DNN.PLATFORM is a popular open-source web content management system that allows users to create and manage websites. It provides a range of features including user management, content editing, and customizable templates. However, like many web applications, it is susceptible to security vulnerabilities, including cross-site scripting (XSS) attacks, which can compromise user data and application integrity.
Vulnerability Detail
DNN.PLATFORM contains a vulnerability that allows an attacker to craft a specially formatted request to the Activity Feed Attachments endpoint. This request can inject malicious scripts that will be rendered in the activity feed, leading to a stored cross-site scripting (XSS) attack. If exploited, this vulnerability could allow attackers to execute arbitrary scripts in the context of the user's browser, potentially stealing sensitive information or performing actions on behalf of the user.
How To Fix
Minimum fixed version
10.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize user inputs and outputs in the Activity Feed to prevent script execution. Implementing strict content security policies (CSP) may also help mitigate the risk of XSS attacks until the package is updated.
Conclusion
The DNN.PLATFORM vulnerability (CVE-2025-52485) allows for stored cross-site scripting attacks through the Activity Feed Attachments endpoint. It is crucial to update to version 10.0.1 or later to mitigate this risk. Implementing workarounds can provide temporary protection while you prepare for the update.
See every vulnerability recorded for DNN.PLATFORM →
FAQ
A stored XSS vulnerability occurs when an attacker is able to inject malicious scripts into a web application, which are then stored on the server and executed in the browser of users who access the affected content.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to analyze your application's packages.
If exploited, this vulnerability could allow attackers to execute scripts in the context of a user's session, potentially leading to data theft, session hijacking, or unauthorized actions performed on behalf of the user.
Yes, once you update to the patched version (10.0.1 or later), the vulnerability will be resolved, and it is safe to use DNN.PLATFORM.
If you cannot update the package right away, implement input sanitization and consider using content security policies to reduce the risk of XSS attacks until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for DNN.PLATFORM.
