{"id":"GHSA-657c-wxg6-jmqv","aliases":["CVE-2025-63644"],"title":"pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability","description":"A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.","severity":"medium","score":6.1,"published":"2026-01-14T18:31:37.000Z","modified":"2026-02-03T03:11:10.676Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"ph7software/ph7builder","ranges":[{"events":[{"introduced":"0"},{"last_affected":"17.9.1"}],"type":"ECOSYSTEM"}],"versions":["1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.1","1.4.2","10.0.8","10.2.0","12.0.0","12.1.0","12.1.2","12.3.0","12.3.5","12.5.9","12.6.0","12.6.1","12.6.5","12.9.0","12.9.7","12.9.8","12.9.9","14.0.0","14.0.0-rc","14.0.0-rc2","14.0.0-rc3","14.3.0","14.3.4","14.3.4-rc","14.3.6","14.7.0","14.8.0","14.8.8","14.8.8-rc","14.8.8-rc2","14.8.9","14.9.0","14.9.0-rc","14.9.0-rc2","15.0.0","15.0.0-beta1","15.0.0-beta2","15.0.0-beta3","15.0.0-rc","15.1.0","15.1.0-beta","15.1.0-rc","15.1.0-rc2","15.1.6","15.1.7","15.1.8","15.2.0","15.3.0","15.3.0-rc.1","15.3.0-rc.2","15.3.0-rc.3","15.4.0","15.4.0-beta.1","15.4.0-beta.2","16.0.0","16.0.0-beta.1","16.0.0-beta.2","16.0.0-rc.1","16.0.0-rc.2","16.0.0-rc.3","16.0.2-beta.1","16.1.0","16.1.0-beta.1","16.1.1","16.2.0","16.2.0-beta.1","16.2.2","16.3.0","16.3.0-beta.1","16.3.2","16.5.0.beta.1","17.0.0-beta.3","17.0.1","17.1.0","17.1.2","17.1.8","17.1.8.beta.1","17.1.8.beta.2","17.2.0","17.2.0-beta.1","17.2.0-rc.1","17.2.0-rc.2","2.0.4","2.0.8","2.0.9","3.0.0","3.1.0","4.0.0","5.0.0","6.0.0","6.0.1","6.0.13","6.0.8","6.0.9","7.0.0","7.0.01","7.1.3","8.0.2","8.0.3","8.0.4","8.0.6","v17.0.0","v17.0.0-beta.2","v17.9.0","v17.9.1","v17.9.1-beta.1"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-63644","https://drive.google.com/drive/folders/1mYDvUTnlTPCGTB-7tHD3pmu_wHtlMVRP","https://github.com/pH7Software/pH7-Social-Dating-CMS","https://medium.com/@rudranshsinghrajpurohit/cve-2025-63644-stored-cross-site-scripting-xss-vulnerability-in-ph7-social-dating-cms-23ed0e7eb853"],"sources":[{"name":"OSV","id":"GHSA-657c-wxg6-jmqv","modified":"2026-02-03T03:11:10.676210Z","url":"https://osv.dev/vulnerability/GHSA-657c-wxg6-jmqv"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}]}