Skip to content
OpenAdvisories
Medium · 5.4 CVE-2025-63644 EUVD-2026-2439GHSA-657c-wxg6-jmqv

pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability

Published Jan 14, 2026 · Updated Jan 22, 2026 · Assigned by mitre

Package: ph7software/ph7builder Ecosystem: Packagist

Description

A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist ph7software/ph7builder <= 17.9.1 — GHSA-657c-wxg6-jmqv

References