CVE-2025-55287: Genealogy has a stored XSS vulnerability

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-18 · updated 2026-06-17
Weakness: CWE-79

Description

Genealogy is a family tree PHP application. Prior to 4.4.0, Authenticated Stored Cross-Site Scripting (XSS) vulnerability was identified in the Genealogy application. Authenticated attackers could run arbitrary JavaScript in another user’s session, leading to session hijacking, data theft, and UI manipulation. This vulnerability is fixed in 4.4.0.

Affected products

MGeurts genealogy: before 4.4.0 — fixed in 4.4.0

How to fix

Upgrade to a fixed version: MGeurts genealogy 4.4.0. Check the vendor advisory for mitigations.

References

https://github.com/MGeurts/genealogy/commit/1683b3cbea5e52c99291fa231b7bc8c33f33c33f
https://github.com/MGeurts/genealogy/security/advisories/GHSA-j457-9m86-6q5r

Get alerted when CVE-2025-55287 or the next vulnerability affects your stack