CVE-2025-66521 Details
Description
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Trusted Certificates feature. A crafted payload can be injected as the certificate name, which is later rendered into the DOM without proper sanitization. As a result, the injected script executes each time the Trusted Certificates view is loaded.
A stored cross-site scripting vulnerability has been identified in Foxit PDF Reader and Foxit PDF Editor within the Trusted Certificates feature. This vulnerability allows for the injection of a crafted payload into the certificate name, which is subsequently rendered in the DOM without adequate sanitization. As a result, the injected script executes each time the Trusted Certificates view is accessed. Affected versions include Foxit PDF Reader 2025.2.1.33197 and earlier, as well as Foxit PDF Editor 2025.2.1.33197 and all previous 2025.x versions, 2024.4.1.27687 and all previous 2024.x versions, 2023.3.0.23028 and all previous 2023.x versions, 14.0.1.33197 and all previous 14.x versions, and 13.2.1.23955 and earlier.
Users can update to the latest versions of Foxit PDF Reader or Foxit PDF Editor. For Foxit PDF Reader, the latest version can be downloaded from the Foxit website or via the application's update feature. For Foxit PDF Editor, the updated version is also available on the Foxit website or through the application's update option.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 19, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.foxit.com/support/security-bulletins.html | Foxit | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Foxit |
Affected Products
| Product | Versions |
|---|---|
| foxit pdf editor cloud | < 2025-12-01 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | Foxit |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 23, 2025 | Initial Analysis | [email protected] |
| Dec 19, 2025 | New CVE Received | Foxit |