Vulnerability · Published May 28, 2025 · Assigned by INCIBE
CVE-2025-40651Reflected Cross Site Scripting (XSS) in Real Easy Store
Medium 5.1
In plain English
A medium-severity cross-site scripting in Real Easy Store from Real Easy Store. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
Reflected Cross-Site Scripting (XSS) vulnerability in Real Easy Store. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the keyword parameter in /index.php?a=search. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Real Easy Store | Real Easy Store | all versions |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N