CVE-2025-12330: Willow CMS Add Post add cross site scripting

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-10-27 · updated 2026-10-08
Weakness: CWE-79

Description

A security flaw has been discovered in Willow CMS up to 1.4.0. This issue affects some unknown processing of the file /admin/articles/add of the component Add Post Page. The manipulation of the argument title/body results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be exploited.

Affected products

Willow CMS: through 1.4.0

References

https://github.com/matthewdeaves/willow/issues/131
https://vuldb.com/?ctiid.330115
https://vuldb.com/?id.330115
https://vuldb.com/?submit.674404
https://www.youtube.com/watch?v=jhFCYpFu9qI

Get alerted when CVE-2025-12330 or the next vulnerability affects your stack