CVE-2025-46786 MEDIUM

CVE-2025-46786: Zoom Workplace Apps - Cross-site Scripting

Vendor Zoom Communications, Inc
Product Zoom Workplace Apps
Weakness CWE-79 · XSS
Published May 14, 2025
Last update October 2, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to impact app integrity via network access.

Key dates

02Disclosure timeline

May 14, 2025 CVE published
October 2, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-1346 Multiple Stored XSS in causefx/organizr CVE-2025-32193 WordPress Simple WP Events plugin <= 1.8.17 - Cross Site Scripting (XSS) vulnerability CVE-2019-1802 Cisco Firepower Management Center Persistent Cross-Site Scripting Vulnerability CVE-2024-49308 WordPress Animator – Scroll Triggered Animations plugin <= 3.0.15 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-42683 WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerability