CVE-2025-27444: Extension - rsjoomla.com - A reflected XSS vulnerability RSform!Pro component 3.0.0 - 3.3.13 for Joomla
Description
A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling of the filter[dateFrom] GET parameter, which is reflected unescaped in the administrative backend interface. This allows an authenticated attacker with admin or editor privileges to inject arbitrary JavaScript code by crafting a malicious URL.
Classification
CVE ID: CVE-2025-27444
Problem Types
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Affected Products
Vendor: rsjoomla.com
Product: RSform!Pro component for Joomla
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.03% (probability of being exploited)
EPSS Percentile: 5.72% (scored less or equal to compared to others)
EPSS Date: 2025-06-05 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-27444https://rsjoomla.com/