Vulnerability · Published Dec 19, 2025 · Assigned by Foxit
CVE-2025-66522Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Digital IDs Common Name Field
Medium 6.3
In plain English
A medium-severity cross-site scripting in pdfonline.foxit.com from Foxit Software Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
A stored cross-site scripting (XSS) vulnerability exists in the Digital IDs functionality of the Foxit PDF Editor Cloud (pdfonline.foxit.com). The application does not properly sanitize or encode the Common Name field of Digital IDs before inserting user-supplied content into the DOM. As a result, embedded HTML or JavaScript may execute whenever the Digital IDs dialog is accessed or when the affected PDF is loaded.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Foxit Software Inc. | pdfonline.foxit.com | before 2025‑12‑01 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N