Medium severity6.3NVD Advisory· Published Dec 19, 2025· Updated Jun 17, 2026

CVE-2025-66500

Description

A stored cross-site scripting (XSS) vulnerability exists in webplugins.foxit.com. A postMessage handler fails to validate the message origin and directly assigns externalPath to a script source, allowing an attacker to execute arbitrary JavaScript when a crafted postMessage is received.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Foxitsoftware/PDF Editor Cloud
cpe:2.3:a:foxit:pdf_editor_cloud:*:*:*:*:*:*:*:*
Range: <2025-12-01
Foxit Software Inc./webplugins.foxit.comv5
Range: before 2025‑12‑01
Foxitsoftware/webplugins.foxit.comllm-create

Patches

Vulnerability mechanics

References

www.foxit.com/support/security-bulletins.htmlnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000