CVE-2017-9070: Modx Revolution

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php.

Affected products

• Modx Modx Revolution: up to and including 2.5.6

Published 2017-05-18. Last modified 2026-06-17.