CVE-2025-27754

A stored XSS vulnerability in RSBlog! component 1.11.6 - 1.14.4 for Joomla was discovered. The vulnerability allows authenticated users to inject malicious JavaScript into the plugin's resource. The injected payload is stored by the application and later executed when other users view the affected content.

• CWE-79

• https://rsjoomla.com/Product

Published

Jun 5, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27749Use after free in Microsoft Office allows an unauthorized at…7.8
• CVE-2025-2775SysAid On-Prem versions <= 23.3.40 are vulnerable to an unau…7.5
• CVE-2025-27750Use after free in Microsoft Office Excel allows an unauthori…7.8
• CVE-2025-27751Use after free in Microsoft Office Excel allows an unauthori…7.8
• CVE-2025-27752Heap-based buffer overflow in Microsoft Office Excel allows …7.8
• CVE-2025-27753A SQLi vulnerability in RSMediaGallery component 1.7.4 - 2.1…6.5
• CVE-2025-27759An improper neutralization of special elements used in an OS…6.7
• CVE-2025-2776SysAid On-Prem versions <= 23.3.40 are vulnerable to an unau…9.8
• CVE-2025-27760Rejected reason: Not used
• CVE-2025-27761Rejected reason: Not used
• CVE-2025-27762Rejected reason: Not used
• CVE-2025-27763Rejected reason: Not used