CVE-2025-66468

The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.0 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042	Patch
https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:aimeos:grapesjs_cms::::::::
	cpe:2.3:a:aimeos:grapesjs_cms::::::::
	cpe:2.3:a:aimeos:grapesjs_cms::::::::
	cpe:2.3:a:aimeos:grapesjs_cms::::::::
	cpe:2.3:a:aimeos:grapesjs_cms::::::::

History

10 Mar 2026, 19:38

Type	Values Removed	Values Added
References	~~() https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042 -~~	() https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042 - Patch
References	~~() https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg -~~	() https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg - Vendor Advisory
CPE		cpe:2.3:a:aimeos:grapesjs_cms::::::::
First Time		Aimeos grapesjs Cms Aimeos

02 Dec 2025, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-12-02 19:15

Updated : 2026-03-10 19:38

NVD link : CVE-2025-66468

Mitre link : CVE-2025-66468

CVE.ORG link : CVE-2025-66468

JSON object : View

Products Affected

aimeos

grapesjs_cms

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-66468", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2025-12-02T19:15:53.310", "references": [{"url": "https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8."}], "lastModified": "2026-03-10T19:38:23.817", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:aimeos:grapesjs_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0FCB6FE-18A7-45B2-B339-0BD693C023EC", "versionEndExcluding": "2021.10.8", "versionStartIncluding": "2021.04.1"}, {"criteria": "cpe:2.3:a:aimeos:grapesjs_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F2DCAA9-41AC-4650-940C-8053478BA456", "versionEndExcluding": "2022.10.9", "versionStartIncluding": "2022.04.1"}, {"criteria": "cpe:2.3:a:aimeos:grapesjs_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FF92937-D16D-475A-AD25-CB1BABC551A5", "versionEndExcluding": "2023.10.15", "versionStartIncluding": "2023.04.1"}, {"criteria": "cpe:2.3:a:aimeos:grapesjs_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08BF8C10-4F1F-4734-BD4C-40DE39959FB0", "versionEndExcluding": "2024.10.8", "versionStartIncluding": "2024.04.1"}, {"criteria": "cpe:2.3:a:aimeos:grapesjs_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B5E16CE-DC04-4A08-A975-922B6ECE1F00", "versionEndExcluding": "2025.10.2", "versionStartIncluding": "2025.04.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}