PT-2026-2927 · Ph7Software · Ph7-Social-Dating-Cms

Published 2026-01-14 · Updated 2026-01-23 · CVE-2025-63644

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions pH7Software pH7-Social-Dating-CMS version 17.9.1

Description A stored cross-site scripting (XSS) issue exists in the user profile Description field. This allows for the injection of malicious scripts that can be executed when other users view the affected profile.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize the user profile Description field to remove potentially malicious code.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-63644

GHSA-657C-WXG6-JMQV

Affected Products

Ph7-Social-Dating-Cms

References · 10

• 🔥 https://drive.google.com/drive/folders/1mYDvUTnlTPCGTB-7tHD3pmu_wHtlMVRP · Exploit
• https://osv.dev/vulnerability/CVE-2025-63644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63644 · Security Note
• https://osv.dev/vulnerability/GHSA-657c-wxg6-jmqv · Vendor Advisory
• https://github.com/pH7Software/pH7-Social-Dating-CMS · Note
• https://t.me/cveNotify/149515 · Telegram Post
• https://twitter.com/CVEnew/status/2011759597791436802 · Twitter Post
• https://t.me/cveNotify/149675 · Telegram Post
• https://medium.com/@rudranshsinghrajpurohit/cve-2025-63644-stored-cross-site-scripting-xss-vulnerability-in-ph7-social-dating-cms-23ed0e7eb853 · Note
• https://twitter.com/VulmonFeeds/status/2011654239483740227 · Twitter Post