CVE-2025-28010: A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files…

PriorityP425medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.23%

14.1th percentile

A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
modx	modx	<= 3.1.0	—
modx	revolution	0 – 3.1.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.