CVE-2025-70792: Microweber Cross-site Scripting Vulnerability
Summary
CVE-2025-70792: Microweber Cross-site Scripting vulnerability. Affects microweber/microweber versions < 2.0.20. Fixed in 2.0.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Microweber is an open-source content management system (CMS) designed for creating websites and online stores. It offers a user-friendly interface and a variety of features, including drag-and-drop functionality, customizable templates, and built-in e-commerce capabilities. However, like many web applications, it is susceptible to security vulnerabilities, including cross-site scripting (XSS) attacks, which can compromise user data and application integrity.
Vulnerability Detail
The vulnerability identified as CVE-2025-70792 is a Cross-site Scripting (XSS) issue located in the '/admin/category/create' endpoint of Microweber version 2.0.19. An attacker can exploit this vulnerability by manipulating the 'rel_id' parameter in a specially crafted URL. If a user with admin privileges is tricked into visiting this URL, the attacker can execute arbitrary JavaScript code in the victim's browser. This could lead to unauthorized actions being performed on behalf of the admin user, potentially compromising sensitive data and application functionality.
How To Fix
Minimum fixed version
2.0.20
This is the first release that contains the fix.
composer require microweber/microweber:2.0.20Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the '/admin/category/create' endpoint until the package can be updated. This can be done by implementing access controls or disabling the feature until the patch is applied.
Conclusion
The CVE-2025-70792 vulnerability in Microweber presents a significant risk due to its potential for exploitation via Cross-site Scripting. It is crucial for users to update to version 2.0.20 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for microweber/microweber →
FAQ
Cross-site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft or unauthorized actions.
You can check if your installation is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your application's composer.lock file.
If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript in the browser of an admin user, leading to unauthorized access, data manipulation, or even complete takeover of the application.
Yes, to prevent XSS attacks, developers should validate and sanitize user inputs, use Content Security Policy (CSP) headers, and keep software up to date with security patches.
If immediate updates are not possible, consider implementing strict access controls to sensitive endpoints and educating users about the risks of clicking on untrusted links.
Related vulnerabilities
Recent vulnerabilities recorded for microweber/microweber.
