Unrated severityNVD Advisory· Published Dec 19, 2025· Updated Dec 19, 2025
Foxit webplugins.foxit.com Stored Cross-Site Scripting via postMessage Vulnerability
CVE-2025-66500
Description
A stored cross-site scripting (XSS) vulnerability exists in webplugins.foxit.com. A postMessage handler fails to validate the message origin and directly assigns externalPath to a script source, allowing an attacker to execute arbitrary JavaScript when a crafted postMessage is received.
Affected products
2- Foxit Software Inc./webplugins.foxit.comv5Range: before 2025‑12‑01
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.