PT-2025-23925 · Rsblog! · Rsblog!

Kamil Szczurowski + 1 · Published 2025-06-05 · Updated 2025-06-16 · CVE-2025-27754

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions RSBlog! component versions 1.11.6 through 1.14.4

Description A stored XSS issue allows authenticated users to inject malicious JavaScript into the plugin's resource. The injected payload is stored by the application and later executed when other users view the affected content.

Recommendations For RSBlog! component versions 1.11.6 through 1.14.4, update to a version that contains a fix for this issue to prevent malicious JavaScript injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-27754

Affected Products

Rsblog!

References · 8

• https://osv.dev/vulnerability/CVE-2025-27754 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27754 · Security Note
• https://t.me/cvenotify/125822 · Telegram Post
• https://t.me/cvetracker/25514 · Telegram Post
• https://twitter.com/dailycve/status/1934709049913954499 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1930643573520617813 · Twitter Post
• https://twitter.com/CVEnew/status/1930623760232821004 · Twitter Post
• https://rsjoomla.com · Note