Is CVE-2025-71430 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-71430 being exploited in the wild.

How severe is CVE-2025-71430?

Medium severity, with a CVSS score of 5.4, published 12 October 2026.

Which products and versions are affected?

Frappe before 14.99.10, 15.x before 15.91.1.

Is there a fix for CVE-2025-71430?

Yes: fixed in Frappe 14.99.10, 15.91.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-71430 attacked?

It is attacked over the network.

Am I affected by CVE-2025-71430?

Check whether you run Frappe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-71430: Frappe stored cross-site scripting in leaderboard

CVE-2025-71430 · Severity: medium · CVSS 5.4 · Published 2026-10-12

Frappe is a web application framework used to build business applications. A stored cross-site scripting vulnerability in the leaderboard page allows authenticated users to inject malicious code through their user names, which then executes in the browsers of other users viewing the leaderboard. An attacker could steal session tokens, redirect users to malicious sites, or perform unauthorized actions on their behalf.

Technologies: Frappe. Vendors: Frappe.

Quick answers

Is CVE-2025-71430 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-71430 being exploited in the wild.
How severe is CVE-2025-71430?: Medium severity, with a CVSS score of 5.4, published 12 October 2026.
Which products and versions are affected?: Frappe before 14.99.10, 15.x before 15.91.1.
Is there a fix for CVE-2025-71430?: Yes: fixed in Frappe 14.99.10, 15.91.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71430 attacked?: It is attacked over the network.
Am I affected by CVE-2025-71430?: Check whether you run Frappe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Frappe 14.99.10, 15.91.1

Technical details

The leaderboard page fails to properly neutralize user names during rendering, allowing stored XSS injection. An authenticated attacker with the ability to modify their user name can craft a payload that executes arbitrary JavaScript when other users view the leaderboard page. This requires user interaction (viewing the leaderboard) and authenticated access to set the malicious name.

Affected products

Frappe Frappe before 14.99.10, 15.x before 15.91.1

Timeline

2025-12-24: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.