cleantalk
Vulnerabilities and Security Researches

Dropshix, CVE-2025-49898

CVE, Research URL

CVE-2025-49898

Home page URL

Security reports for Dropshix

Application

Dropshix

Published on
Aug 15, 2025
Research Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xolluteon Dropshix allows DOM-Based XSS.This issue affects Dropshix: from n/a through 4.0.14.
Affected versions
Min -, max 4.0.14.
Status
vulnerable
Previous vulnerability researches
WordLift – AI powered SEO – Schema (CVE-2022-3069) , Jun 07, 2024
WordLift – AI powered SEO – Schema (CVE-2025-30624) , Jun 15, 2025
WordLift – AI powered SEO – Schema (CVE-2025-53582) , Aug 16, 2025
WordLift – AI powered SEO – Schema (CVE-2024-12176) , Jan 08, 2025
New vulnerability
Dropshix (CVE-2025-49898) , Aug 18, 2025
Vertical scroll slideshow gallery v2 (CVE-2025-49897) , Aug 18, 2025
Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) , Aug 18, 2025
ServerBuddy by PluginBuddy.com (CVE-2025-49895) , Aug 18, 2025
Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin (CVE-2025-49869) , Aug 18, 2025