CVE-2025-70128

A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier. The application fails to properly sanitize or validate user-supplied input in the "link" field of a comment. An attacker can inject arbitrary JavaScript code using a <script> element. The injected payload is stored in the database and subsequently rendered in the Administration panel's "Comments" section when administrators review submitted comments. Importantly, the malicious script is not reflected in the public-facing comments interface, but only within the backend administration view. Alternatively, users of Administrator, Moderator, Manager roles can also directly input crafted payloads into existing comments. This makes the vulnerability a persistent XSS issue targeting administrative users. This affects /core/admin/comments.php, while CVE-2022-24585 affects /core/admin/comment.php, a uniquely distinct vulnerability.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/forest4x/vuln-research-public/blob/main/CVE-2025-70128.pdf	Exploit Third Party Advisory
https://youtu.be/iOXWpiljV0w	Exploit
https://github.com/forest4x/vuln-research-public/blob/main/CVE-2025-70128.pdf	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pluxml:pluxml:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-10 20:16

Updated : 2026-06-17 10:03

NVD link : CVE-2025-70128

Mitre link : CVE-2025-70128

CVE.ORG link : CVE-2025-70128

JSON object : View

Products Affected

pluxml

pluxml

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-70128", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-70128", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T18:40:47.515364Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-10T20:16:20.427", "references": [{"url": "https://github.com/forest4x/vuln-research-public/blob/main/CVE-2025-70128.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://youtu.be/iOXWpiljV0w", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://github.com/forest4x/vuln-research-public/blob/main/CVE-2025-70128.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier. The application fails to properly sanitize or validate user-supplied input in the \"link\" field of a comment. An attacker can inject arbitrary JavaScript code using a <script> element. The injected payload is stored in the database and subsequently rendered in the Administration panel's \"Comments\" section when administrators review submitted comments. Importantly, the malicious script is not reflected in the public-facing comments interface, but only within the backend administration view. Alternatively, users of Administrator, Moderator, Manager roles can also directly input crafted payloads into existing comments. This makes the vulnerability a persistent XSS issue targeting administrative users. This affects /core/admin/comments.php, while CVE-2022-24585 affects /core/admin/comment.php, a uniquely distinct vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) almacenado existe en la funci\u00f3n de comentarios de art\u00edculos de PluXml para las versiones de PluXml 5.8.22 y anteriores. La aplicaci\u00f3n no logra sanear o validar correctamente la entrada proporcionada por el usuario en el campo 'link' de un comentario. Un atacante puede inyectar c\u00f3digo JavaScript arbitrario usando un elemento "}], "lastModified": "2026-06-17T10:03:09.580", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pluxml:pluxml:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F0CA1A2-CEEA-4454-B7EA-69887ADE63F0", "versionEndIncluding": "5.8.22"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}