What’s Vulnerable › Vulnerabilities

CVE-2021-47913: PHP Melody 3.0 Persistent Cross-Site Scripting via Video Editor

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-01 · updated 2026-06-17
• Weakness: CWE-79

Description

PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers can exploit the WYSIWYG editor to execute persistent scripts, potentially leading to session hijacking and application manipulation.

Affected products

• PHPSUGAR PHP Melody: 3.0

References

• https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/
• https://www.phpsugar.com/phpmelody.html
• https://www.vulncheck.com/advisories/php-melody-persistent-cross-site-scripting-via-video-editor
• https://www.vulnerability-lab.com/get_content.php?id=2291
• https://www.vulnerability-lab.com/get_content.php?id=2291

Get alerted when CVE-2021-47913 or the next vulnerability affects your stack