Loading vulnerability…
Stored XSS in Foxit PDF Online Layer Import (Create new Layer)
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Layer Import functionality. An attacker can inject a crafted script payload into the “Create new Layer” field during layer import; the value is later rendered into the DOM without proper sanitization/encoding. When a user accesses the Layers panel, the stored payload is inserted into the page and executes in the context of the pdfonline.foxit.com origin.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in arbitrary JavaScript execution in victims’ browsers under the pdfonline.foxit.com origin when the Layers panel is accessed. This can enable session/token theft, account actions as the victim, data exfiltration from the application context, and other same-origin impacts typical of stored XSS.
If you can’t patch tonight, do this now.
Until patched, reduce exposure by restricting access to the affected Layer Import feature to trusted users, and deploy/strengthen a restrictive Content Security Policy (CSP) to limit script execution (e.g., disallow inline/eval and restrict script-src). Monitor for suspicious layer names/payload patterns and consider WAF rules to block common XSS payloads targeting the relevant parameter/field.
Patch, then assume compromise.
Apply the vendor-provided fix for CVE-2025-66519. Ensure the “Create new Layer” field is properly sanitized and/or contextually output-encoded before insertion into the DOM, and avoid unsafe DOM sinks (e.g., innerHTML/dangerouslySetInnerHTML) for untrusted content. Add server-side validation to prevent persistence of script-capable markup.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.