High · 8.7 CVE-2025-25018 EUVD-2025-33707GHSA-23vx-2j4v-jvhm

Kibana Stored Cross-Site Scripting (XSS)

Published Oct 10, 2025 · Updated Feb 26, 2026 · Assigned by elastic

Description

Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

Vendor	Product	Affected	Fixed
Elastic	Kibana	7.0.0 – ≤ 7.17.29, 8.0.0 – ≤ 8.18.7, 8.19.0 – ≤ 8.19.4, 9.0.0 – ≤ 9.0.7, 9.1.0 – ≤ 9.1.4	—