How severe is CVE-2025-22602?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.5 out of 10.

What type of vulnerability is CVE-2025-22602?

This is classified as CWE-79, which is a common weakness in software security.

CVE-2025-22602 - MEDIUM Severity | CVSS 6.5

Vulnerability Description

Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary JavaScript on users' browsers by posting a malicious video placeholder html element. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should enable CSP.

Related Vulnerabilities

CVE-2014-9701

MEDIUM

CVSS:6.5(Medium)

Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalink_page....

CWE-792014

CVE-2015-7916

MEDIUM

CVSS:6.5(Medium)

Cross-site scripting (XSS) vulnerability in Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.

CWE-792015

CVE-2016-11085

MEDIUM

CVSS:6.5(Medium)

php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishand...

CWE-792016

CVE-2017-17062

MEDIUM

CVSS:6.5(Medium)

The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev19 allows remote authenticated users to save arbitr...

CWE-792017

CVE-2018-10854

MEDIUM

CVSS:6.5(Medium)

cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scriptin...

CWE-792018

CVE-2018-1253

MEDIUM

CVSS:6.5(Medium)

RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console administrator could potentially exploit ...

CWE-792018