What’s Vulnerable › Vulnerabilities

CVE-2015-9544

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-04-07 · updated 2026-06-17
• Weakness: CWE-20

Description

An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStoragePostMessageApi.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.

Affected products

• Cross Domain Local Storage Project Cross Domain Local Storage: through 2.0.5

References

• https://github.com/ofirdagan/cross-domain-local-storage
• https://github.com/ofirdagan/cross-domain-local-storage/issues/17
• https://github.com/ofirdagan/cross-domain-local-storage/pull/19
• https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-Origin-Magic-iframe
• https://github.com/ofirdagan/cross-domain-local-storage
• https://github.com/ofirdagan/cross-domain-local-storage/issues/17
• https://github.com/ofirdagan/cross-domain-local-storage/pull/19
• https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-Origin-Magic-iframe

Get alerted when CVE-2015-9544 or the next vulnerability affects your stack