Back to Database
Status published
High
CVE-2025-64112
Statmatic vulnerable to Stored Cross-Site Scripting
Vulnerability Description
Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fixed in 5.22.1.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64112
Credits & Attribution
No credits recorded in the NVD database.
References
More from statamic
View All →CVE-2024-52600
Statamic CMS has Path Traversal in Asset Upload
Medium
5.3
CVE-2024-36119
Password confirmation stored in plain text via registration form in statamic/cms
Low
1.8
CVE-2024-24570
Statamic account takeover via XSS and password reset link
High
8.2
CVE-2023-48701
Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
High
7.5
CVE-2023-48217
Remote code execution via form uploads in statamic/cms
High
8.8
Affected Vendor
statamic
View all reports →Affected Software
cms
Vulnerable Versions:
< 5.22.1
Timeline
Official Publish:
October 30th, 2025
Last Modified:
October 30th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H