What’s Vulnerable › Vulnerabilities

CVE-2017-1000223

• Severity: medium (CVSS 5.4 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-11-17 · updated 2026-06-17
• Weakness: CWE-79

Description

A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an escalation of privileges providing complete administrative control over the CMS.

Affected products

• Modx Revolution: through 2.5.6

References

• https://raw.githubusercontent.com/modxcms/revolution/v2.5.7-pl/core/docs/changelog.txt
• https://raw.githubusercontent.com/modxcms/revolution/v2.5.7-pl/core/docs/changelog.txt

Get alerted when CVE-2017-1000223 or the next vulnerability affects your stack