CVE-2025-70959: Tendenci CMS Jobs Module Stored XSS Vulnerability
Summary
CVE-2025-70959: A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload. Affects tendenci versions 11.0 – 7.5.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Tendenci CMS is an open-source content management system designed for managing websites, particularly for organizations and businesses. It provides features such as event management, membership management, and job postings. The Jobs module allows users to post job listings, but it has a vulnerability that can be exploited to execute arbitrary scripts.
Vulnerability Detail
A stored cross-site scripting (XSS) vulnerability exists in the Jobs module of Tendenci CMS version 15.3.7. This vulnerability allows attackers to inject malicious scripts or HTML into the application, which can then be executed in the context of other users' browsers. The origin of this vulnerability lies in insufficient input validation, enabling attackers to manipulate the input fields. The ramifications include potential data theft, session hijacking, and unauthorized actions performed on behalf of users. The CVSS score for this vulnerability is 5.4, indicating a moderate level of risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input sanitization on the affected fields to prevent script injection. This can be done by escaping special characters in user inputs before rendering them on the page.
Conclusion
The stored XSS vulnerability in the Jobs module of Tendenci CMS poses a significant risk to users. It is crucial to update to the patched version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for tendenci →
FAQ
A stored XSS vulnerability allows attackers to inject malicious scripts into a web application, which are then stored and executed when other users access the affected content.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring signup.
The impacts include data theft, session hijacking, and unauthorized actions performed on behalf of users, which can compromise user security and trust.
Yes, a patch is available in version 15.3.8 of the Tendenci package. It is recommended to update to this version or later.
The CVSS score of this vulnerability is 5.4, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for tendenci.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
