CVE-2016-7150: Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users...

Security readout for executives and security teams

CVE-2016-7150 is an authenticated XSS flaw in b2evolution 6.7.5 and earlier. A logged-in user could place script or HTML in the site name, causing browser-side code to run when that value is viewed. Business impact depends on who can change site settings and who later views the affected pages. Exposure is likely limited to organizations still running b2evolution 6.7.5 or earlier where authenticated users can modify the site name or related settings. Internet-facing administrative interfaces raise concern, but the source bundle does not identify default roles, hosting patterns, or exact privilege requirements. Treat as a legacy CMS hygiene issue with moderate urgency. Prioritize if b2evolution is internet-facing, handles authenticated users, or has multiple content administrators. No active exploitation is cited in the supplied sources, but unsupported or old CMS software should be remediated promptly. Mitigation focus: Inventory b2evolution deployments and identify versions at or below 6.7.5.; Review the vendor commit and apply the corresponding fixed release or vendor-supported patch.; Restrict site-name or settings changes to trusted administrators only..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.