CVE-2025-63589: Cross-site Scripting
Source CVE Database V5
Not known to be exploited · CVSS 7.1 High.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 28% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 6 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
European organizations should immediately audit their CMSimple_XH 1.8 installations to determine exposure to this vulnerability. 2) Use web application firewalls (WAFs) with rules designed to detect and block reflected XSS attack patterns targeting URL paths. 3) Educate users and administrators about the risks of clicking on suspicious URLs, especially those containing unusual path segments. 4) Monitor web server logs for anomalous requests with suspicious URL patterns indicative of exploitation attempts. 5) Consider temporarily disabling or restricting access to vulnerable components if feasible. 6) Stay alert for official patches or updates from CMSimple_XH developers and apply them promptly once released. 7) Implement Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts in browsers. These measures, combined, will reduce the risk until a permanent fix is deployed.
Description
A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs, search form action, footer links). An attacker-controlled string placed in the URL path is reflected into multiple HTML elements, allowing execution of arbitrary JavaScript in victims' browsers visiting a crafted URL.