CVE-2025-47204 Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data
Developers using this library's example code may expose applications to reflective XSS and CSRF attacks if they copy the vulnerable PHP script structure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-47204?
CVE-2025-47204 is a medium-severity cross-site scripting vulnerability in n/a, published on 13 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).
Weakness: CWE-352
Which versions are affected by CVE-2025-47204?
2 open source packages ship an affected version, including bootstrap-multiselect. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bootstrap-multiselect npm | All versions | 2.0.0 |
bootstrap-multiselect npm | All versions | 2.0.0 |
Products include Davidstutz Bootstrap Multiselect.
How do I fix CVE-2025-47204?
Upgrade bootstrap-multiselect to 2.0.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-47204 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-47204 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-gv5r-9gxr-v74w.