CVE-2025-70960: Tendenci CMS stored XSS in Forums and Jobs modules

CVE-2025-70960 · Severity: medium · CVSS 5.4 · Published 2026-02-03

Tendenci CMS, an open-source platform for managing non-profit organizations and associations, contains a security flaw in its Forums and Jobs modules. An attacker can post malicious content that, when viewed by other users or administrators, executes unauthorized scripts in their browsers. This could lead to the theft of login sessions, unauthorized access to sensitive member data, or the defacement of the organization's website.

Technologies: tendenci (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-70960 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-70960 being exploited in the wild.
How severe is CVE-2025-70960?
Medium severity, with a CVSS score of 5.4, published 3 February 2026.
Which products and versions are affected?
tendenci (PyPI) <= 16.14, ECOSYSTEM:introduced=0,last_affected=15.3.7, ECOSYSTEM:introduced=0,last_affected=16.14.
Is there a fix for CVE-2025-70960?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-70960 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2025-70960?
Check whether you run tendenci (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Tendenci CMS (v16.14 and earlier) due to improper neutralization of user-controllable input before it is rendered in web pages. Specifically, the 'Subject' and 'Message' fields in the Forums module, as well as 'Job title' and other free-text fields in the Jobs module, fail to sanitize or encode input. An authenticated attacker with low privileges can inject malicious JavaScript payloads that are persistently stored in the database. These payloads execute automatically in the browser of any user—including administrators—who views the affected forum topic or job listing. This can result in session hijacking via cookie theft or unauthorized actions performed on behalf of the victim.

Affected products

  • Tendenci Tendenci CMS <= 16.14

Identifiers

  • CVE-2025-70960
  • GHSA-6fvp-wmh6-jg95
  • PYSEC-2026-138

Timeline

  • 2025-10-16: other: Vulnerability discovered by researcher
  • 2026-02-02: disclosed: NVD publication date
  • 2026-02-03: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.