CVE-2023-25440: Civicrm

Medium severity, CVSS 5.4. EPSS: 2.5% chance of exploitation in the next 30 days.

Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.

Affected products

• Civicrm Civicrm: version 5.59 only

Published 2023-05-23. Last modified 2026-06-17.