Stored XSS Vulnerability in Perch CMS by Perch Runway

CVE-2025-66686

What is CVE-2025-66686?

A stored Cross-Site Scripting vulnerability has been identified in Perch CMS version 3.2, which could be exploited by an authenticated attacker with administrative privileges. The attacker can insert malicious JavaScript code into the 'Help button url' setting in the admin panel. Once the payload is stored, it executes when any authenticated user clicks the Help button. This security flaw poses significant risks, including session hijacking, information disclosure, privilege escalation, and unauthorized administrative actions, making it crucial for users to address this vulnerability promptly.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References