CVE-2025-66468
Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors
The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors
The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.
- Record
CVE-2025-66468- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-200307
The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.
- Record
EUVD-2025-200307- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-424m-fj2q-g7vg
Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors
Impact
Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled.
Workaround
If the standard CSP rules are active (default in production mode), an exploit isn't possible.
Credits
Lwin Min Oo [email protected]
- Record
GHSA-424m-fj2q-g7vg- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.
- Record
CVE-2025-66468- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors
The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.
- Record
CVE-2025-66468- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-424m-fj2q-g7vg
Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors
Impact
Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled.
Workaround
If the standard CSP rules are active (default in production mode), an exploit isn't possible.
Credits
Lwin Min Oo [email protected]
- Record
GHSA-424m-fj2q-g7vg- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aimeos/ai-cms-grapesjsPackagist |
2021.04.1 up to 2021.10.8 | 2021.10.8 |
aimeos/ai-cms-grapesjsPackagist |
2022.04.1 up to 2022.10.9 | 2022.10.9 |
aimeos/ai-cms-grapesjsPackagist |
2023.04.1 up to 2023.10.15 | 2023.10.15 |
aimeos/ai-cms-grapesjsPackagist |
2024.04.1 up to 2024.10.8 | 2024.10.8 |
aimeos/ai-cms-grapesjsPackagist |
2025.04.1 up to 2025.10.2 | 2025.10.2 |
aimeos/ai-cms-grapesjsPackagist |
2021.04.1 up to 2021.10.8, plus listed versions 2021.04.22021.04.32021.04.42021.04.52021.04.6 Show 14 moreShow less2021.07.12021.07.22021.07.32021.07.42021.07.52021.07.62021.07.72021.10.12021.10.22021.10.32021.10.42021.10.52021.10.62021.10.7 |
2021.10.8 |
aimeos/ai-cms-grapesjsPackagist |
2022.04.1 up to 2022.10.9, plus listed versions 2022.04.22022.04.32022.04.42022.07.12022.07.2 Show 9 moreShow less2022.07.32022.10.12022.10.22022.10.32022.10.42022.10.52022.10.62022.10.72022.10.8 |
2022.10.9 |
aimeos/ai-cms-grapesjsPackagist |
2023.04.1 up to 2023.10.15, plus listed versions 2023.04.22023.07.12023.07.22023.07.32023.07.4 Show 14 moreShow less2023.10.12023.10.102023.10.112023.10.122023.10.132023.10.142023.10.22023.10.32023.10.42023.10.52023.10.62023.10.72023.10.82023.10.9 |
2023.10.15 |
aimeos/ai-cms-grapesjsPackagist |
2024.04.1 up to 2024.10.8, plus listed versions 2024.04.22024.04.32024.04.42024.04.52024.04.6 Show 10 moreShow less2024.07.12024.07.22024.07.32024.10.12024.10.22024.10.32024.10.42024.10.52024.10.62024.10.7 |
2024.10.8 |
aimeos/ai-cms-grapesjsPackagist |
2025.04.1 up to 2025.10.2, plus listed versions 2025.04.22025.07.12025.07.22025.10.1 |
2025.10.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-66468 is a high vulnerability (CVSS 7.7) in Aimeos Grapesjs Cms, published December 2, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in aimeos/ai-cms-grapesjs 2021.10.8.
References
github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg
nvd.nist.gov/vuln/detail/CVE-2025-66468