CVE-2025-54297

Vulnerability

Overview

CComment component versions 5.0.0 through 6.1.14 for Joomla contain a stored cross-site scripting (XSS) vulnerability [1]. The component fails to properly sanitize user input before storing it, allowing an attacker to inject arbitrary JavaScript into web pages served to other users.

Attack

Vector

To exploit the vulnerability, an attacker must have the ability to submit content that is stored and later displayed by the component. No authentication is explicitly required if the component allows unauthenticated comments. The attack does not require a privileged network position; it can be performed over the public internet.

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to session hijacking, defacement, or theft of sensitive information displayed on the affected pages.

Mitigation

The developer of CComment has announced the end-of-life of the component [1]. No patched version will be released, and users are advised to remove or replace the component immediately.