CVE-2025-63644
pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability
CVE-2025-63644 is a medium vulnerability (CVSS 5.4) in Ph7builder Ph7 Social Dating Builder, published January 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. No source names a fixed version.
A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.
- Record
CVE-2025-63644- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-2439
A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.
- Record
EUVD-2026-2439- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-657c-wxg6-jmqv
pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.
- Record
GHSA-657c-wxg6-jmqv- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.
- Record
CVE-2025-63644- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-657c-wxg6-jmqv
pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.
- Record
GHSA-657c-wxg6-jmqv- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ph7software/ph7builderPackagist |
through 17.9.1 | None known |
ph7software/ph7builderPackagist |
through 17.9.1, plus listed versions 1.3.51.3.61.3.71.3.81.3.9 Show 45 moreShow less1.4.01.4.11.4.210.0.810.2.012.0.012.1.012.1.212.3.012.3.512.5.912.6.012.6.112.6.512.9.012.9.712.9.812.9.914.0.014.0.0-rc14.0.0-rc214.0.0-rc314.3.014.3.414.3.4-rc14.3.614.7.014.8.014.8.814.8.8-rc14.8.8-rc214.8.914.9.014.9.0-rc14.9.0-rc215.0.015.0.0-beta115.0.0-beta215.0.0-beta315.0.0-rc15.1.015.1.0-beta15.1.0-rc15.1.0-rc215.1.6 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
drive.google.com/drive/folders/1mYDvUTnlTPCGTB-7tHD3pmu_wHtlMVRP
medium.com/@rudranshsinghrajpurohit/cve-2025-63644-stored-cross-site-scripting-xss-vulnerability-in-ph7-social-dating-cms-23ed0e7eb853
nvd.nist.gov/vuln/detail/CVE-2025-63644
github.com/advisories/GHSA-657c-wxg6-jmqv
Left out here: 62 versions. The JSON record has them.