CVE-2025-39397

Summary

CVE-2025-39397 is a Cross-Site Scripting (XSS) vulnerability affecting Anything Popup, a component used in emails from the [email protected] domain. The issue arises due to improper neutralization of user input during web page generation. An attacker can exploit this vulnerability to inject malicious scripts into the web pages viewed by other users, leading to potential theft of sensitive information or unauthorized system access. This flaw impacts all versions of Anything Popup from the unspecified n/a through 7.3. It is essential for affected organizations to apply the necessary security patches as soon as possible to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.