CVE-2025-70128

A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier. The application fails to properly sanitize or validate user-supplied input in the "link" field of a comment. An attacker can inject arbitrary JavaScript code using a <script> element. The injected payload is stored in the database and subsequently rendered in the Administration panel's "Comments" section when administrators review submitted comments. Importantly, the malicious script is not reflected in the public-facing comments interface, but only within the backend administration view. Alternatively, users of Administrator, Moderator, Manager roles can also directly input crafted payloads into existing comments. This makes the vulnerability a persistent XSS issue targeting administrative users. This affects /core/admin/comments.php, while CVE-2022-24585 affects /core/admin/comment.php, a uniquely distinct vulnerability.

• CWE-79

• https://github.com/forest4x/vuln-research-public/blob/main/CVE-2025-70128.pdfExploit, Third Party Advisory
• https://youtu.be/iOXWpiljV0wExploit
• https://github.com/forest4x/vuln-research-public/blob/main/CVE-2025-70128.pdfExploit, Third Party Advisory

Published

Mar 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-7011Heap out-of-bounds read vulnerability in Avast Antivirus whe…7.8
• CVE-2025-70116A NULL pointer dereference in GPAC MP4Box: when parsing cert…4.3
• CVE-2025-7012An issue in Cato Networks' CatoClient for Linux, before vers…8.6
• CVE-2025-70121An array index out of bounds vulnerability in the AMF compon…7.5
• CVE-2025-70122A heap buffer overflow vulnerability in the UPF component of…7.5
• CVE-2025-70123An improper input validation and protocol compliance vulnera…7.5
• CVE-2025-70129If the anti spam-captcha functionality in PluXml versions 5.…5.3
• CVE-2025-7013Authorization Bypass Through User-Controlled Key vulnerabili…9.8
• CVE-2025-7014Session Fixation vulnerability in QR Menu Pro Smart Menu Sys…8.8
• CVE-2025-70141SourceCodester Customer Support System 1.0 contains an incor…9.4
• CVE-2025-70146Missing authentication in multiple administrative action scr…9.1
• CVE-2025-70147Missing authentication in /admin/student.php and /admin/teac…7.5