CVE-2025-63588: Cmsimple-Xh Cmsimple Xh

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted request (e.g., a maliciously crafted POST login). Successful exploitation may lead to theft of session cookies, credential disclosure, or other client-side impacts.

Affected products

Published 2025-11-06. Last modified 2026-06-17.