Vulnerability · Published Dec 2, 2025 · Assigned by GitHub_M
CVE-2025-66468Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors
High 7.7
In plain English
A high-severity cross-site scripting in ai-cms-grapesjs from aimeos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | aimeos/ai-cms-grapesjs | 2021.10.8 | GHSA-424m-fj2q-g7vg |
| Packagist | aimeos/ai-cms-grapesjs | 2022.10.9 | GHSA-424m-fj2q-g7vg |
| Packagist | aimeos/ai-cms-grapesjs | 2023.10.15 | GHSA-424m-fj2q-g7vg |
| Packagist | aimeos/ai-cms-grapesjs | 2024.10.8 | GHSA-424m-fj2q-g7vg |
| Packagist | aimeos/ai-cms-grapesjs | 2025.10.2 | GHSA-424m-fj2q-g7vg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| aimeos | ai-cms-grapesjs | >= 2021.04.1, < 2021.10.8>= 2022.04.1, < 2022.10.9>= 2023.04.1, < 2023.10.15>= 2024.04.1, < 2024.10.8>= 2025.04.1, < 2025.10.2 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H