CVE-2025-9980
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website.
Risk Assessment
An attacker with admin privileges can steal user data, hijack sessions, or conduct attacks on visitors, potentially leading to security and reputation compromise of the website.
Recommendation
It is recommended to restrict admin privileges, apply input validation, and update QuickCMS to the latest version if available, as well as monitor vendor communications.
Other vulnerabilities in QuickCMS
See all- CVE-2026-33386Low
QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin-fetching mechanism. An attacker can perform a Man-in-the-Middle (MITM) attack by impersonating the opensolution.org server and serving arbitrary HTML or JavaScript at the plugin list endpoint. The issue was fixed in a patch to version 6.8 published on 15.05.2026.
- CVE-2026-33384Medium
QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This enables an attacker to fix a session ID for a victim and later hijack the authenticated session.
- CVE-2026-1468Medium
QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft a special website that, when visited by the victim, automatically sends a POST request with the victim's privileges. No protection is implemented. Fixed in version 6.8 (14.05.2026).
- CVE-2025-9982High
A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This flaw allows attackers with access to the source code or the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
- CVE-2025-10018Medium
QuickCMS is vulnerable to multiple Stored XSS in the language editor functionality (languages). A malicious attacker with admin privileges can inject arbitrary HTML and JS into the website, which will be rendered/executed on every page. By default, an admin user is not able to add JavaScript into the website.
- CVE-2025-9981Medium
QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website.
Original NVD description (English source)
QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS