CVE-2025-66502

MediumCVSS 6.3

Published: 19/12/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Page Templates feature. A crafted payload can be stored as the template name and is rendered into the DOM without proper sanitization, causing the injected script to execute each time the affected PDF is loaded.

Risk Assessment

An attacker can execute arbitrary JavaScript in the context of a user's session when they open an affected PDF document, potentially leading to data theft or account takeover.

Recommendation

Avoid opening PDF documents from untrusted sources in pdfonline.foxit.com until a fix is released, and report the issue to the vendor.

Other vulnerabilities in pdfonline.foxit.com

CVE-2025-66519Medium
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Layer Import functionality. A crafted payload injected into the “Create new Layer” field during layer import is rendered into the DOM without proper sanitization, causing the injected script to execute when the Layers panel is accessed.

Original NVD description (English source)

A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Page Templates feature. A crafted payload can be stored as the template name, which is later rendered into the DOM without proper sanitization. As a result, the injected script executes each time the affected PDF is loaded.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS