CVE-2024-58285 MEDIUM

CVE-2024-58285: Chyrp 2.5.2 Stored Cross-Site Scripting Vulnerability via Post Title

Vendor Chyrp
Product Chyrp
Weakness CWE-79 · XSS
Published December 10, 2025
Last update March 5, 2026

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can craft payloads in the title field that will execute when the post is viewed by other users, potentially stealing session cookies or performing client-side attacks.

Key dates

02Disclosure timeline

December 10, 2025 CVE published
March 5, 2026 Record updated