CVE-2025-60298

5.4 mediumEPSS 0.3%

Medium (5.4) in xxyopen novel-plus. EPSS 0.3% chance of exploitation in the next 30 days.

Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint. This vulnerability allows authenticated attackers to inject malicious JavaScript code through the indexName parameter, which gets stored in the database and executed when other users view the affected book chapter.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-10-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

xxyopen:novel-plus

References

https://github.com/201206030/novel-plus
https://notes.sjtu.edu.cn/s/FB0dX82qf
https://notes.sjtu.edu.cn/s/FB0dX82qf#

Check your stack JSON