Reflected XSS Vulnerability in RSform!Pro for Joomla
CVE-2025-27444

4.8MEDIUM

Key Information:

Vendor

Rsjoomla.com

Status
Rsform!pro Component For Joomla
Vendor
CVE Published:
4 June 2025

What is CVE-2025-27444?

A reflected XSS vulnerability has been identified in RSform!Pro versions 3.0.0 to 3.3.13 for Joomla. This security flaw stems from inadequate handling of the filter[dateFrom] GET parameter, which is displayed without escaping in the administrative backend interface. Through this vulnerability, an authenticated attacker with admin or editor privileges can craft a specially designed URL to execute arbitrary JavaScript code, potentially compromising the affected system.

Affected Version(s)

RSform!Pro component for Joomla 3.0.0-3.3.13

References

https://rsjoomla.com/
product

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kamil Szczurowski
Robert Kruczek
.