Not scored
CVE-2025-66500
Foxit webplugins.foxit.com Stored Cross-Site Scripting via postMessage Vulnerability
Foxit Software Inc.webplugins.foxit.com
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
0.2%probability of exploitation in the next 30 days
Higher than 11% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
A stored cross-site scripting (XSS) vulnerability exists in webplugins.foxit.com. A postMessage handler fails to validate the message origin and directly assigns externalPath to a script source, allowing an attacker to execute arbitrary JavaScript when a crafted postMessage is received.
Coverage 1 article · 1 outlet
- ThreatsDay Bulletin: OpenSSL RCE, Foxit 0-Days, Copilot Leak, AI Password Flaws & 20+ StoriesThe Hacker News · first in our coverage · mentions it in passing