CVE-2015-9544

Improper Input Validation in xdLocalStorage

7.1 High

CVE-2015-9544 is a high vulnerability (CVSS 7.1) in Cross Domain Local Storage Project Domain Local Storage, published April 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.33%, the 71st percentile. No source names a fixed version.

An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStoragePostMessageApi.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

1.33%Up 0.1 points since Feb 4, 2022

What each source reports

NVD Score used 7.1

Record: CVE-2015-9544
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-9544
Updated: 2026-11-02

EUVDEUVD-2021-2595 No score

Record: EUVD-2021-2595
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vrc7-6g8w-jh56 7.1

Improper Input Validation in xdLocalStorage

Record: GHSA-vrc7-6g8w-jh56
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSVGHSA-vrc7-6g8w-jh56 7.1

Improper Input Validation in xdLocalStorage

Record: GHSA-vrc7-6g8w-jh56
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

Affected products

cross domain local storage project domain local storage

Affected packages

Affected packages
Package	Affected	Fixed
`xdLocalStorage` npm	through 2.0.5	None known
`xdlocalstorage` npm	through 2.0.5	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV