CVE-2025-64112

HIGH

Statamic CMS < 5.22.1 - Authenticated Stored Cross-Site Scripting in Collections and Taxonomies

Title source: llm
STIX 2.1

Description

Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fixed in 5.22.1.

References (2)

Core 2

Scores

CVSS v3 8.0
EPSS 0.0028
EPSS Percentile 19.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-79
Status published
Products (2)
statamic/cms 0 - 5.22.1Packagist
statamic/cms < 5.22.1
Published Oct 30, 2025
Tracked Since Feb 18, 2026