CVE-2025-54421 NamelessMC allows Stored Cross Site Scripting (XSS) in SEO component
Authenticated attackers can inject arbitrary scripts via the default_keywords parameter in NamelessMC, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-54421?
CVE-2025-54421 is a high-severity cross-site scripting vulnerability in NamelessMC Nameless, published on 18 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.4 allows remote authenticated attackers to inject arbitrary web script or HTML via the default_keywords crafted parameter. This vulnerability is fixed in 2.2.4.
Which versions are affected by CVE-2025-54421?
It affects 1 product.
Products include Namelessmc Nameless.
How do I fix CVE-2025-54421?
No fix has been published for CVE-2025-54421 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-54421 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54421 exists.
Other vulnerabilities in NamelessMC Nameless
- CVE-2022-2821 Missing Critical Step in Authentication in namelessmc/nameless
- CVE-2025-54117 NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor
- CVE-2025-22144 Account Takeover in NamelessMC
- CVE-2025-32389 NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages
- CVE-2025-29784 NamelessMC Has Lack of Length Validation for s Parameter in GET Requests
Sources
Also known as GHSA-f5rm-w4mx-q7rx.