CVE-2025-1239

MediumCVSS 4.8/10Last modified Aug 8, 2026

Description

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Blocked Sites list. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user.

Metrics

CVSS 4.0 4.8/10CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Feb 14, 2025
Last modified
Aug 8, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-123906.0A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device andCVE-2025-123915.3The Restrictions for BuddyPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check onCVE-2025-123925.3The Cryptocurrency Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing CVE-2025-123934.4The Free Quotation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includingCVE-2025-123945.9The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unaCVE-2025-123964.4The clubmember plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.CVE-2025-123977.6A SQL injection vulnerability was found in Looker Studio. A Looker Studio user with report view access could inject malicious SQL that woulCVE-2025-123986.1The Product Table for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_key' parameter in allCVE-2025-123997.2The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validaCVE-2025-12408.8WinZip 7Z File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrCVE-2025-124006.1The LMB^Box Smileys plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2. This is due CVE-2025-124016.1The Label Plugins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to
CVE-2025-1239: Medium severity, CVSS 4.8 | Vulnix