CVE-2024-58289 Microweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields

What is CVE-2024-58289?

CVE-2024-58289 is a medium-severity cross-site scripting vulnerability in Microweber Microweber, published on 11 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Attackers can input script payloads in the first name field that will execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.

Weakness: CWE-79

Which versions are affected by CVE-2024-58289?

It affects 1 product.

Products include Microweber Microweber.

How do I fix CVE-2024-58289?

No fix has been published for CVE-2024-58289 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-58289 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-58289 exists.

Other vulnerabilities in Microweber Microweber

• CVE-2022-0558 Cross-site Scripting (XSS) - Stored in microweber/microweber Critical 9.8
• CVE-2020-23138 File upload in n/a Critical 9.8
• CVE-2022-0688 Business Logic Errors in microweber/microweber Critical 9.4
• CVE-2022-0660 Generation of Error Message Containing Sensitive Information in microweber/microweber Critical 9.4
• CVE-2022-0913 Integer Overflow or Wraparound in microweber/microweber Critical 9.1

All Microweber Microweber vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mhwg-hvw8-9w84.