Executive brief
Tendenci CMS, an open-source platform used by non-profits and associations to manage memberships and content, contains a security flaw in its Jobs and Forums modules. An attacker with basic user permissions can save malicious scripts into the website's database. When other users or administrators view the affected job listings or forum posts, these scripts execute automatically, potentially leading to session hijacking, unauthorized data access, or the defacement of the website.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Tendenci CMS v15.3.7 due to improper neutralization of user-controllable input in the Jobs and Forums modules. Specifically, fields such as 'Job title', 'URL Path', and forum 'Subject' or 'Message' do not sufficiently sanitize input before storing it in the database or encode it before rendering it to other users. An authenticated attacker with low privileges can inject a malicious JavaScript payload that executes in the context of any user (including administrators) who views the affected content. This can lead to session cookie theft, unauthorized actions performed on behalf of other users, and potential administrative account takeover. As of the advisory date, no official patch has been released.
Affected products
- Tendenci Tendenci CMS <= 15.3.7
Timeline
- 2025-10-16: disclosed: Vulnerability discovered and PoC created by researcher
- 2026-02-02: advisory: NVD published CVE-2025-70959
- 2026-02-03: advisory: GitHub Advisory GHSA-g7hj-29xq-r64w published