Vulnerability · Published Jan 23, 2026 · Assigned by VulnCheck
CVE-2025-71177LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and Search
Medium 5.1
In plain English
A medium-severity cross-site scripting in LavaLite CMS from LavaLite. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Official description
LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is stored and later rendered without proper output encoding in package search results. When other users view search results that include the malicious package, the injected script executes in their browsers, potentially enabling session hijacking, credential theft, and unauthorized actions in the context of the victim.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | lavalite/cms | no fix listed | GHSA-w7rq-fgx4-4xcm |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LavaLite | LavaLite CMS | 0 – through 10.1.0 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References
- https://github.com/LavaLite/cms/issues/420 issue-tracking
- https://lavalite.org/ product
- https://www.vulncheck.com/advisories/lavalite-cms-stored-xss-via-package-creation-and-search third-party-advisory