ADVISORIES

• CVE-2021-25974 (NVD)
• GHSA-wmh9-x28j-c6gr
• Vendor Advisory

GEM

publify_core

SEVERITY

CVSS v3.x: 5.4 (Medium)

UNAFFECTED VERSIONS

• < 8.0

PATCHED VERSIONS

• >= 9.2.5

DESCRIPTION

In Publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS. A user with a 'publisher' role is able to inject and execute arbitrary JavaScript code while creating a page/article.

RELATED

• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25974