CVE-2025-12518

beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality. Malicious attacker can inject arbitrary HTML and JS into template, which will be rendered/executed when visiting preview page. However due to beefree's Content Security Policy not all payloads will execute successfully. This issue has been fixed in version 3.47.0.

CVSS

No CVSS.

References

Link	Resource
https://beefree.io/
https://cert.pl/en/posts/2026/03/CVE-2025-12518

Configurations

No configuration.

History

No history.

Information

Published : 2026-03-18 11:16

Updated : 2026-06-17 08:32

NVD link : CVE-2025-12518

Mitre link : CVE-2025-12518

CVE.ORG link : CVE-2025-12518

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-12518", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12518", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-18T14:20:57.418984Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "Bee Content Design", "product": "Befree SDK", "versions": [{"status": "affected", "version": "0", "lessThan": "3.47.0", "versionType": "semver"}], "defaultStatus": "unknown"}]}], "published": "2026-03-18T11:16:14.530", "references": [{"url": "https://beefree.io/", "source": "cvd@cert.pl"}, {"url": "https://cert.pl/en/posts/2026/03/CVE-2025-12518", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality. Malicious attacker can inject arbitrary HTML and JS into template, which will be rendered/executed when visiting preview page. However due to beefree's Content Security Policy not all payloads will execute successfully.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in version 3.47.0."}, {"lang": "es", "value": "El SDK de beefree.io es vulnerable a XSS Almacenado en el par\u00e1metro URL del icono de Red Social en la funcionalidad de creaci\u00f3n de correos electr\u00f3nicos. Un atacante malicioso puede inyectar HTML y JS arbitrarios en la plantilla, que ser\u00e1n renderizados/ejecutados al visitar la p\u00e1gina de vista previa. Sin embargo, debido a la Pol\u00edtica de Seguridad de Contenido de beefree, no todas las cargas \u00fatiles se ejecutar\u00e1n con \u00e9xito.\n\nEste problema ha sido solucionado en la versi\u00f3n 3.47.0."}], "lastModified": "2026-06-17T08:32:31.410", "sourceIdentifier": "cvd@cert.pl"}

CVE-2025-12518

JSON object

Attach tags to CVE-2025-12518

Attach tags to `CVE-2025-12518`