CVE-2025-27754

MEDIUM

RSBlog! 1.11.6-1.14.4 - Authenticated Stored Cross-Site Scripting

Title source: llm
STIX 2.1

Description

A stored XSS vulnerability in RSBlog! component 1.11.6 - 1.14.4 for Joomla was discovered. The vulnerability allows authenticated users to inject malicious JavaScript into the plugin's resource. The injected payload is stored by the application and later executed when other users view the affected content.

References (1)

Core 1
Core References
Product product
https://rsjoomla.com/

Scores

CVSS v3 6.5
EPSS 0.0019
EPSS Percentile 8.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
rsjoomla/rsform\!blog 1.11.6 - 1.14.4
Published Jun 05, 2025
Tracked Since Feb 18, 2026