Stored XSS Vulnerability in Creativeitem Sociopro Web Application

CVE-2025-40992

What is CVE-2025-40992?

A stored cross-site scripting (XSS) vulnerability exists in the Creativeitem Sociopro application owing to inadequate validation of user inputs. This vulnerability can be exploited via the '/sociopro/profile/update_profile' endpoint, specifically through the 'name' parameter in a POST request. An attacker could leverage this flaw to send crafted requests to an authenticated user, potentially allowing them to hijack the user’s session by accessing their cookie information.

References