CVE-2025-66520 MEDIUM

CVE-2025-66520: Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Portfolio SVG Handling

Vendor Foxit Software Inc.
Product pdfonline.foxit.com
Weakness CWE-79 · XSS
Published December 19, 2025
Last update December 19, 2025
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

What the vulnerability does

01Description

A stored cross-site scripting (XSS) vulnerability exists in the Portfolio feature of the Foxit PDF Editor cloud (pdfonline.foxit.com). User-supplied SVG files are not properly sanitized or validated before being inserted into the HTML structure. As a result, embedded HTML or JavaScript within a crafted SVG may execute whenever the Portfolio file list is rendered.

Key dates

02Disclosure timeline

December 19, 2025 CVE published
December 19, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-10810 itsourcecode Fees Management System navbar.php cross site scripting CVE-2011-10039 Nagios XI < 2011R1.9 XSS via Alert Heatmap Report & “My Reports” Listing CVE-2023-45769 WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS) CVE-2025-53458 WordPress Goracash Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability CVE-2024-8681 Premium Addons for Elementor <= 4.10.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid Widget