CVE-2025-2340

Summary

CVE-2025-2340 is a newly disclosed cross-site scripting (XSS) vulnerability affecting the otale Tale Blog 2.0.5. The flaw lies within the saveOptions function located in the /options/save component of Site Settings. By manipulating the Site Title argument, an attacker can inject malicious scripts into a victim's website, potentially gaining unauthorized access. The exploit can be triggered remotely, posing a significant risk. Although the vendor was notified about this disclosure, no response was received. Unfortunately, this issue only impacts unsupported versions of the product.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.