CVE-2025-53523: Groupsession

Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. A logged-in user can prepare a malicious page or URL, and an arbitrary script may be executed on the web browser when another user accesses it.

Affected products

• Groupsession Groupsession: before 5.3.0 (fixed in 5.3.0); before 5.3.2 (fixed in 5.3.2); before 5.3.3 (fixed in 5.3.3)

Published 2025-12-12. Last modified 2026-10-07.