CVE-2025-55287

This PoC demonstrates an authenticated stored XSS vulnerability in a Genealogy app (versions prior to 4.4.0) where an attacker with Editor+ privileges can inject malicious JavaScript into a person's firstname/lastname field. When a higher-privileged user deletes the person, the script executes, sending a CSRF token and snapshot data to add the attacker as an Administrator via a Livewire component update.