Quick answers
- Is CVE-2025-13873 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-13873 being exploited in the wild.
- How severe is CVE-2025-13873?
- Medium severity, with a CVSS score of 5.4, published 2 December 2025.
- Which products and versions are affected?
- Objectplanet Opinio 7.26 rev12562 and earlier.
- Is there a fix for CVE-2025-13873?
- A patch was published on 2025-07-31: Fixed in version 7.27 with XSS security enhancements Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-13873 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2025-13873?
- Check whether you run Objectplanet Opinio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562, where user-supplied input from imported survey data is not properly sanitized or encoded before being stored and displayed to other users. An attacker can craft a malicious survey file with embedded JavaScript that, when imported, gets stored in the application database and executed in the browsing context of any visitor accessing the compromised survey. The vulnerability requires an authenticated user with survey import privileges to upload the malicious survey file. This was addressed in version 7.27 with security enhancements related to XSS prevention and updates to the CKEditor library (4.22.1) and jQuery UI library (1.14.1).
Affected products
- ObjectPlanet Opinio 7.26 rev12562 and earlier
Timeline
- 2025-12-02: disclosed
- 2025-07-31: patched: Fixed in version 7.27 with XSS security enhancements