CVE-2025-66468

Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors

State: Published
Severity: 7.7 High
Published: Dec 2, 2025
Updated: Dec 2, 2025
Reserved: Dec 2, 2025

Description

The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.

Scores

CVSS	Score	Vector	Source
3.1	7.7 High	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
ai-cms-grapesjsaimeos	>= 2021.04.1, < 2021.10.8Affected >= 2022.04.1, < 2022.10.9Affected >= 2023.04.1, < 2023.10.15Affected >= 2024.04.1, < 2024.10.8Affected >= 2025.04.1, < 2025.10.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.