Medium severity5.4NVD Advisory· Published Oct 12, 2026· Updated Oct 12, 2026

CVE-2025-71430

Description

Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard.

Affected products

Frappe/Frappellm-fuzzy
Range: <14.99.10, <15.91.1

Patches

Vulnerability mechanics

References

github.com/frappe/frappe/security/advisories/GHSA-cx24-w5gm-5vv9nvd
www.vulncheck.com/advisories/frappe-before-15.91.1-stored-xss-via-leaderboard-user-namesnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000