CVE-2025-60144

MediumCVSS 5.9

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The Lenix scss compiler plugin has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 1.2.

Risk Assessment

Malicious code can be stored and executed in users' browsers, potentially leading to site security compromise.

Recommendation

Update the Lenix scss compiler plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in Lenix scss compiler

CVE-2025-60145Medium
The Lenix scss compiler plugin (up to version 1.2) contains a Cross-Site Request Forgery (CSRF) vulnerability, allowing an attacker to perform unauthorized actions in the context of a logged-in user.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Lenix scss compiler lenix-scss-compiler allows Stored XSS.This issue affects Lenix scss compiler: from n/a through <= 1.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS