CVE-2025-70128

CVE-2025-70128 is a Stored Cross-Site Scripting (XSS) vulnerability affecting PluXml versions 5.8.22 and earlier, specifically within the article comments feature. An attacker can inject malicious JavaScript into the "link" field of a comment, which is then stored and executed when an administrator views the comment in the backend administration panel. This vulnerability targets administrative users, allowing for persistent XSS attacks within the /core/admin/comments.php section. The attack vector is through user-supplied input in the comment link field, requiring an administrator to view the crafted comment for the payload to execute. While not publicly reflected, the impact could include session hijacking or unauthorized actions within the administrative interface. There is no CVSS score provided, but the persistent nature makes it a moderate to high severity for targeted administrators. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has received no community discussion or media coverage, indicating a low level of public awareness or active threat.