CVE-2025-59545: Critical XSS Flaw in DNN Software Puts 750,000 Websites at Risk

CVE-2025-59545 is a critical stored cross-site scripting (XSS) flaw in DNN Software’s Prompts module that could allow attackers to inject scripts into DNN content and have them execute in a user’s browser, potentially hijacking administrator sessions or altering site configurations. DNN warns that the vulnerability exists in how the Prompt module executes certain commands and processes their output, with malicious input able to bypass sanitisation when routed through specific commands.

The advisory notes the issue affects versions prior to 10.1.0, leaving a substantial install base exposed, and assigns a CVSS score of 9.1. DNN states the platform powers over 750,000 websites worldwide, with more than 8 million downloads and a community of 1 million members. A patch has been released as version 10.1.0, and organisations are urged to update immediately or restrict access to the Prompt module and monitor admin activity logs for signs of suspicious command execution, according to GHSA-2qxc-mf4x-wr29. The article was published on 24 September 2025.