CVE-2025-10758
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was detected in htmly up to version 3.1.0 in the /htmly/admin/field/post file of the Custom Field Handler component. Manipulating the label argument leads to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.
Risk Assessment
A remote attacker could execute a malicious script in the user's browser, potentially leading to session or data theft. The vendor's lack of response means no official fix is available.
Recommendation
Implement validation and sanitization of the label argument and consider using a WAF. Monitor for available updates and consider alternative solutions if no fix is released.
Other vulnerabilities in htmly
See all- CVE-2026-37107Critical
An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component.
- CVE-2026-18644Medium
A vulnerability in danpros HTMLy up to 3.1.1, affecting the unlink function in /system/htmly.php of the Delete Username Endpoint component, allows manipulation of the File argument leading to path traversal. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2022-25022Medium
A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to execute arbitrary HTML scripts via a crafted payload in the content field of a blog post.
Original NVD description (English source)
A security vulnerability has been detected in htmly up to 3.1.0. The impacted element is an unknown function of the file /htmly/admin/field/post of the component Custom Field Handler. Such manipulation of the argument label leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS