HTML Injection Flaw in Vox Media's Chorus CMS

CVE-2025-40730

What is CVE-2025-40730?

A security vulnerability in Vox Media's Chorus CMS allows an attacker to exploit HTML injection, enabling the execution of malicious JavaScript code in the victim's browser. By manipulating the 'q' parameter in the '/search' endpoint, threat actors can craft harmful URLs that, when clicked by users, may lead to data theft, including session cookies. Consequently, this can facilitate unauthorized actions on behalf of the victim, posing significant risks to user data and application integrity.

References