PyroCMS vulnerabilities

PyroCMS 3.9 is vulnerable to a stored XSS attack, allowing a low-privileged user (e.g., author) to inject malicious HTML and JavaScript into blog post content. This can lead to full admin account takeover or privilege escalation.

PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject malicious scripts. A payload in the 'Redirect From' field executes arbitrary JavaScript when administrators view the redirects page.

PyroCMS version 3.9 was found to contain multiple cross-site scripting (XSS) vulnerabilities.