Stored XSS Vulnerability in SOPlanning by SOPlanning Team
CVE-2025-62296

5.1MEDIUM

Key Information:

Vendor

Soplanning

Status
Soplanning
Vendor
CVE Published:
20 November 2025

What is CVE-2025-62296?

SOPlanning is prone to a stored Cross-Site Scripting (XSS) vulnerability located at the /taches endpoint. An attacker with medium privileges can exploit this flaw to inject arbitrary HTML and JavaScript code, which would then be executed within the editor environment. This could allow the attacker to manipulate session information or perform malicious actions on behalf of other users. This vulnerability was addressed in version 1.55 of SOPlanning. Users are recommended to upgrade to the latest version to mitigate potential risks.

Affected Version(s)

SOPlanning 0 < 1.55

References

https://cert.pl/en/posts/2025/11/CVE-2025-62293
third-party-advisory
https://www.soplanning.org/en/
product

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ɓukasz Jaworski (Pentest Limited)
JSON
.
CVE-2025-62296 : Stored XSS Vulnerability in SOPlanning by SOPlanning Team