CVE-2025-46479

CVSS 3.1 Score 6.5 of 10 (medium)

Details

Published Apr 24, 2025
Updated: Apr 29, 2025
CWE ID 79

Summary

CVE-2025-46479 is a Cross-site Scripting (XSS) vulnerability affecting BBCode Deluxe, a plugin used for formatting messages in online forums. The flaw, which is DOM-Based, permits attackers to inject malicious scripts into web pages generated by the plugin. This issue exists in versions of BBCode Deluxe up to and including 2020.08.01.2. Successful exploitation can lead to unauthorized data access or theft, and potentially more serious consequences such as account takeover or system compromise.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share