CVE-2025-13873

4.8 mediumEPSS 0.2%

Medium (4.8) in objectplanet opinio. EPSS 0.2% chance of exploitation in the next 30 days.

Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.

Severity

CVSS 4.0

4.8 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-12-02
Modified: 2026-09-03
Record from: the NVD, synced 2026-10-19

Affected

objectplanet:opinio

References

https://www.objectplanet.com/opinio/changelog.html

Check your stack JSON