CVE-2025-30676

CVE-2025-30676: Apache OFBiz: Stored XSS Vulnerability

Vendor Apache Software Foundation
Product Apache OFBiz
Weakness CWE-80 · XSS · basic
Published April 1, 2025
Last update April 2, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19. Users are recommended to upgrade to version 18.12.19, which fixes the issue.

Key dates

02Disclosure timeline

April 1, 2025 CVE published
April 2, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-12753 Chart Expert <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-15058 Responsive Pricing Table <= 5.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'table_currency' CVE-2026-39712 WordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerability CVE-2025-11265 VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-57928 WordPress AWP Classifieds plugin <= 4.4.3 - Content Injection vulnerability