# CVE-2025-70959: Tendenci CMS stored XSS in Jobs and Forums modules

Source: https://junglewise.ai/threats/cve-2025-70959-tendenci-cms-stored-xss-in-jobs-and-forums-modules  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-03. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2025-70959 · Severity: medium · CVSS 5.4 · Published 2026-02-03

Tendenci CMS, an open-source platform used by non-profits and associations to manage memberships and content, contains a security flaw in its Jobs and Forums modules. An attacker with basic user permissions can save malicious scripts into the website's database. When other users or administrators view the affected job listings or forum posts, these scripts execute automatically, potentially leading to session hijacking, unauthorized data access, or the defacement of the website.

Technologies: [tendenci (PyPI)](https://junglewise.ai/threats/technologies/tendenci). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-70959 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-70959 being exploited in the wild.

**How severe is CVE-2025-70959?** Medium severity, with a CVSS score of 5.4, published 3 February 2026.

**Which products and versions are affected?** tendenci (PyPI) <= 15.3.7, ECOSYSTEM:introduced=0,last_affected=15.3.7.

**Is there a fix for CVE-2025-70959?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-70959 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-70959?** Check whether you run tendenci (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Tendenci CMS v15.3.7 due to improper neutralization of user-controllable input in the Jobs and Forums modules. Specifically, fields such as 'Job title', 'URL Path', and forum 'Subject' or 'Message' do not sufficiently sanitize input before storing it in the database or encode it before rendering it to other users. An authenticated attacker with low privileges can inject a malicious JavaScript payload that executes in the context of any user (including administrators) who views the affected content. This can lead to session cookie theft, unauthorized actions performed on behalf of other users, and potential administrative account takeover. As of the advisory date, no official patch has been released.

## Affected products

- Tendenci Tendenci CMS <= 15.3.7

## Identifiers

- CVE-2025-70959
- GHSA-g7hj-29xq-r64w
- PYSEC-2026-137

## Timeline

- 2025-10-16: disclosed: Vulnerability discovered and PoC created by researcher
- 2026-02-02: advisory: NVD published CVE-2025-70959
- 2026-02-03: advisory: GitHub Advisory GHSA-g7hj-29xq-r64w published

## References

- [https://github.com/emirhanyucelll/tendenci/blob/main/Readme.md](https://github.com/emirhanyucelll/tendenci/blob/main/Readme.md)
- [https://github.com/pypa/advisory-database/tree/main/vulns/tendenci/PYSEC-2026-137.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/tendenci/PYSEC-2026-137.yaml)

## Related threats

- [PYSEC-2026-1950 - Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization](https://junglewise.ai/threats/cve-2026-23946-tendenci-helpdesk-authenticated-remote-code-execution-via-pickle)
- [Tendenci CMS stored XSS in Forums and Jobs modules](https://junglewise.ai/threats/cve-2025-70960-tendenci-cms-stored-xss-in-forums-and-jobs-modules)
- [Tendenci CSV formula injection in contact form message field](https://junglewise.ai/threats/cve-2020-36962-tendenci-csv-formula-injection-in-contact-form-message-field)
- [PYSEC-2020-112 - Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.](https://junglewise.ai/threats/cve-2020-14942-deserialization-of-untrusted-data-in-tendenci)