Security readout for executives and security teams
Plain-English summary
CVE-2025-46041 is a stored XSS issue reported in Anchor CMS v0.12.7. Someone with access to create pages can place JavaScript in the page description field. That script may later run in another user’s browser, potentially exposing session data or altering page/admin behavior.
Executive priority
Treat as a moderate-priority web application risk. It is not reported as actively exploited, but stored XSS can affect administrators and trusted users. Prioritize if Anchor CMS is internet-facing or has many content editors.
Technical view
The issue is CWE-79 stored cross-site scripting in /admin/pages/add, specifically the page description field. CVSS 3.1 is 5.4 with network access, low attack complexity, low privileges required, and user interaction required. Scope is changed, with low confidentiality and integrity impact and no availability impact.
Likely exposure
Exposure is limited to environments running Anchor CMS v0.12.7 where an attacker can access the page creation interface or compromise an account with that capability.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. A public GitHub reference exists, but the provided evidence only supports the vulnerability description, not widespread exploitation.
Researcher notes
The CVE record names Anchor CMS v0.12.7, but the affected product metadata in the source bundle is incomplete. No patch version is provided in the supplied sources. Avoid assuming exploit maturity beyond the public reference.
Mitigation direction
- Check Anchor CMS vendor/project guidance for an official fix or upgrade path.
- Restrict access to the admin page creation interface to trusted users only.
- Review and sanitize existing page description content for unexpected scripts or HTML.
- Apply server-side output encoding and input validation where maintainers recommend it.
- Monitor administrative accounts for unauthorized page creation or edits.
Validation and detection
- Confirm whether any deployed instance is Anchor CMS v0.12.7.
- Identify who can access /admin/pages/add in production.
- Review page descriptions for suspicious script-like content.
- Test remediation in staging before production deployment.
- Verify browser execution is prevented after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-46041 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N2.32.7CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/binneko/CVE-2025-46041CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.