CVE-2025-67349

A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the application fails to properly sanitize input in the <head> section, allowing remote attackers to inject arbitrary script tags.

CVSS 3.1

6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-25)

CWE

CWE-79

Published

2025-12-26

Modified

2026-10-13

Record from

the NVD, synced 2026-10-19

Affected

• fluentcms:fluentcms

References

• https://github.com/eoniboogie/CVE_Disclosures/blob/main/CVE-2025-67349/CVE-2025-67349.md
• https://github.com/fluentcms/FluentCMS/issues/2403

Check your stackJSON