Cross Site Scripting Vulnerability in Microweber by Microweber
CVE-2025-70791

6.1MEDIUM

Key Information:

Vendor

Microweber

Status
Microweber
Vendor
CVE Published:
5 February 2026

What is CVE-2025-70791?

A Cross Site Scripting vulnerability in Microweber version 2.0.19 allows an attacker to manipulate the "orderDirection" parameter within the "/admin/order/abandoned" endpoint. This can be exploited by luring a user with admin privileges to visit a specially crafted URL, enabling unauthorized JavaScript code execution in the victim's browser. The vulnerability has been addressed in version 2.0.20 following reports to the developers.

References

https://github.com/microweber/microweber/commit/aa0791fc2...
https://gist.github.com/TimRecktenwald/9615b9915a4cacda9f...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.