Loading vulnerability…
Stored XSS in Foxit PDF Online (pdfonline.foxit.com) Predefined Text via Identity First Name
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com in the Foxit eSign “Predefined Text” feature. An attacker can store a crafted script payload in the Identity “First Name” field; the application later renders this value into the DOM without proper sanitization/encoding. When predefined text is used or when document properties are viewed, the stored payload is inserted into the page and may execute in the victim’s browser context.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in execution of arbitrary JavaScript in the context of pdfonline.foxit.com for users who trigger the vulnerable rendering path (e.g., using predefined text or viewing document properties). This can enable session/token theft, account actions as the victim, data exposure within the application, and other browser-based impacts consistent with stored XSS.
If you can’t patch tonight, do this now.
Until patched, reduce exposure by restricting who can set/modify Identity fields used by Predefined Text, and implement/strengthen a restrictive Content Security Policy (CSP) to limit script execution impact. Add server-side validation to reject/neutralize script-capable characters/patterns in the affected field and monitor for suspicious payloads in identity/profile attributes.
Patch, then assume compromise.
Apply the vendor-provided fix/patch for CVE-2025-66501. Ensure the Identity “First Name” (and any other identity/profile fields) are treated as untrusted and are contextually output-encoded before insertion into the DOM; avoid unsafe DOM sinks (e.g., innerHTML) for user-controlled content, or sanitize with a robust allowlist-based HTML sanitizer if HTML is required.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.