Loading vulnerability…
Stored XSS in Foxit PDF Online Page Templates (pdfonline.foxit.com)
A stored cross-site scripting (XSS) vulnerability in pdfonline.foxit.com exists in the Page Templates feature. An attacker can store a crafted JavaScript payload in the template name; when the template name is later rendered into the DOM without proper sanitization/encoding, the payload executes in the victim’s browser each time the affected PDF is loaded.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in arbitrary JavaScript execution in the context of pdfonline.foxit.com when a victim loads the affected PDF/template. This can enable session/token theft, account takeover actions performed as the victim, data exfiltration from the application context, and UI redressing/phishing within the trusted origin.
If you can’t patch tonight, do this now.
Until patched, reduce exposure by restricting who can create/modify Page Templates, monitoring for suspicious template names, and enforcing a restrictive CSP (e.g., disallow inline script and limit script-src to trusted origins) to reduce exploit reliability/impact.
Patch, then assume compromise.
Apply the vendor patch/mitigation that ensures template names are safely handled on both write and render paths (e.g., strict server-side validation and context-appropriate output encoding; avoid inserting untrusted strings via unsafe DOM sinks such as innerHTML/dangerouslySetInnerHTML).
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.