CVE-2025-25197: 
PHP vulnerability analysis and mitigation

Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. A Cross-Site Scripting (XSS) vulnerability was discovered that allows an elemental block to include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability was discovered in April 2025 and affects versions prior to 5.3.12 (NVD, GitHub Advisory).

The vulnerability is specific to the "Content blocks in use" report and occurs due to a failure to cast input prior to including it in the grid field. The issue has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (GitHub Advisory).

When exploited, this vulnerability allows attackers to execute arbitrary web script or HTML through the Content blocks in use report. This could potentially lead to theft of sensitive browser-based data or manipulation of website content for users viewing the report (NVD).

The vulnerability requires low attack complexity and no user interaction, though it does require low privileges to exploit. The attack can be launched remotely over the network (GitHub Advisory).

The vulnerability has been fixed in version 5.3.12 of the Silverstripe Elemental module. Users are advised to upgrade to this version or later to address the security issue. The fix involves proper input casting before including content in the grid field (Silverstripe).