CVE-2022-25022
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to execute arbitrary HTML scripts via a crafted payload in the content field of a blog post.
Risk Assessment
An attacker can inject malicious HTML code, leading to user session theft, website defacement, or sensitive data theft.
Recommendation
Immediately update Htmly to the latest version and implement input filtering and output encoding for content fields.
Other vulnerabilities in Htmly
See all- CVE-2026-37107Critical
An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component.
- CVE-2026-18644Medium
A vulnerability in danpros HTMLy up to 3.1.1, affecting the unlink function in /system/htmly.php of the Delete Username Endpoint component, allows manipulation of the File argument leading to path traversal. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2025-10758Low
A cross-site scripting (XSS) vulnerability was detected in htmly up to version 3.1.0 in the /htmly/admin/field/post file of the Custom Field Handler component. Manipulating the label argument leads to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a crafted payload in the content field of a blog post.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS