CVE-2025-66519

A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Layer Import functionality. A crafted payload can be injected into the “Create new Layer” field during layer import and is later rendered into the DOM without proper sanitization. As a result, the injected script executes when the Layers panel is accessed.

Score

CVSS 3.1 6.3 Medium

Status

Analyzed - 14984358-7092-470d-8f34-ade47a7658a2

Published

2025-12-19

Last modified

2025-12-19

Weaknesses

CWE-79

Affected products

• Pdf Editor Cloud (Foxit)
• Pdfonline.foxit.com (Foxit Software Inc.)

References

• https://www.foxit.com/support/security-bulletins.html