CVE-2025-63644
pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability
CVE-2025-63644 is a medium vulnerability (CVSS 5.4) in Ph7builder Ph7 Social Dating Builder, published January 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. No source names a fixed version.
- Severity
- 5.4 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.29%EPSS, 22nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ph7software/ph7builderPackagist | through 17.9.1 | None known |
ph7software/ph7builderPackagist | through 17.9.1, plus listed versions 1.3.51.3.61.3.71.3.81.3.9 Show 45 moreShow less1.4.01.4.11.4.210.0.810.2.012.0.012.1.012.1.212.3.012.3.512.5.912.6.012.6.112.6.512.9.012.9.712.9.812.9.914.0.014.0.0-rc14.0.0-rc214.0.0-rc314.3.014.3.414.3.4-rc14.3.614.7.014.8.014.8.814.8.8-rc14.8.8-rc214.8.914.9.014.9.0-rc14.9.0-rc215.0.015.0.0-beta115.0.0-beta215.0.0-beta315.0.0-rc15.1.015.1.0-beta15.1.0-rc15.1.0-rc215.1.6 | None known |
What each source reports
CVE List Score used
A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.
- Record
CVE-2025-63644- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-2439
A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.
- Record
EUVD-2026-2439- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-657c-wxg6-jmqv
pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.
- Record
GHSA-657c-wxg6-jmqv- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.
- Record
CVE-2025-63644- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-657c-wxg6-jmqv
pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.
- Record
GHSA-657c-wxg6-jmqv- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
drive.google.com/drive/folders/1mYDvUTnlTPCGTB-7tHD3pmu_wHtlMVRP
medium.com/@rudranshsinghrajpurohit/cve-2025-63644-stored-cross-site-scripting-xss-vulnerability-in-ph7-social-dating-cms-23ed0e7eb853
nvd.nist.gov/vuln/detail/CVE-2025-63644
github.com/advisories/GHSA-657c-wxg6-jmqv
Left out here: 62 versions. The JSON record has them.