CVE-2025-66492: Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-12 · updated 2026-10-14
Weakness: CWE-79

Description

Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 through 7.5.1 are vulnerable to XSS when an unsanitized value of the ajax URL query parameter is directly included within the <head> section of the HTML page. An attacker can execute arbitrary scripts in the context of the user's session, potentially leading to Session Hijacking, Data Theft, Defacement and Malware Distribution. This issue is fixed in versions 7.5.2, 7.4.9, 7.3.14, and 7.2.9. To work around this issue, configure a Web Application Firewall (WAF) rule (e.g., ModSecurity) to block requests containing common XSS payload characters in the ajax query parameter. Alternatively, implement server-side sanitization using middleware to strip or escape dangerous characters from the ajax parameter before it reaches the vulnerable rendering logic.

Affected products

MasaCMS: before 7.2.9; from 7.3.1 before 7.3.14; from 7.4.0 before 7.4.9; from 7.5.0 before 7.5.2 — fixed in 7.2.9, 7.3.14, 7.4.9, 7.5.2

How to fix

Upgrade to a fixed version: MasaCMS 7.2.9, 7.3.14, 7.4.9, 7.5.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-66492 or the next vulnerability affects your stack