CVE-2025-70960: Stored XSS Vulnerability in Tendenci CMS v15.3.7
Summary
CVE-2025-70960: A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload. Affects tendenci versions 11.0 – 7.5.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tendenci CMS is an open-source content management system designed for managing websites and online communities. It offers features such as user management, event scheduling, and forums, making it a popular choice for organizations looking to create interactive platforms. However, version 15.3.7 of Tendenci CMS has a vulnerability that allows attackers to exploit the Forums module through stored cross-site scripting (XSS).
Vulnerability Detail
The stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to inject malicious scripts or HTML into the forum posts. This can lead to unauthorized actions being performed on behalf of users, data theft, and the potential compromise of user accounts. The vulnerability arises from inadequate input validation, allowing crafted payloads to be stored and executed when other users view the affected posts.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable the Forums module in Tendenci CMS until the vulnerability is patched. This can be done by accessing the admin panel and navigating to the modules section to deactivate the Forums feature.
Conclusion
The stored XSS vulnerability in Tendenci CMS v15.3.7 poses a significant risk to users and their data. It is crucial to update the package to the latest version to protect against potential exploitation. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for tendenci →
FAQ
A stored XSS vulnerability allows attackers to inject malicious scripts into a web application, which are then stored on the server and executed in the browsers of users who access the affected content.
If exploited, this vulnerability can lead to unauthorized actions being taken on behalf of users, potentially compromising their accounts and sensitive information.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The CVSS score of this vulnerability is 5.4, indicating a moderate level of risk.
If you cannot update the package, consider disabling the Forums module as a temporary workaround to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for tendenci.
