https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-67291.htmlhttps://patchthecve.com/cve/CVE-2025-67291.htmlSun, 05 Jul 2026 02:17:35 +0000MEDIUM 6.1: A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name field.https://patchthecve.com/cve/CVE-2025-67290.htmlhttps://patchthecve.com/cve/CVE-2025-67290.htmlSun, 05 Jul 2026 02:17:35 +0000MEDIUM 6.1: A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Excerpt field.https://patchthecve.com/cve/CVE-2025-61413.htmlhttps://patchthecve.com/cve/CVE-2025-61413.htmlWed, 17 Jun 2026 09:50:30 +0000MEDIUM 6.1: A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary web scripts or HTML via creating a page and injecting a crafted payload into the Markdown blocks.https://patchthecve.com/cve/CVE-2025-57692.htmlhttps://patchthecve.com/cve/CVE-2025-57692.htmlWed, 17 Jun 2026 09:43:17 +0000MEDIUM 6.8: PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser.https://patchthecve.com/cve/CVE-2024-55341.htmlhttps://patchthecve.com/cve/CVE-2024-55341.htmlWed, 17 Jun 2026 08:11:04 +0000MEDIUM 4.7: A stored cross-site scripting (XSS) vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by creating a page via the /manager/pages and then adding a markdown content with the XSS payload.https://patchthecve.com/cve/CVE-2024-55342.htmlhttps://patchthecve.com/cve/CVE-2024-55342.htmlWed, 17 Jun 2026 08:11:04 +0000MEDIUM 4.7: A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PDF can contain malicious JavaScript code, which is executed when a victim user opens or interacts with the PDF in their web browser, leading to a XSS vulnerabil