# lavalite/cms (Packagist) vulnerabilities

14 known vulnerabilities (1 critical, 1 high, 4 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/lavalite/cms

## Advisories (14)

### [CVE-2025-71177](https://cve.now/CVE-2025-71177): LavaLite CMS \<= 10.1.0 Stored XSS via Package Creation and Search

- Severity: Medium 5.1
- Published: Jan 23, 2026
- Affected: through 10.1.0.

### [CVE-2024-31828](https://cve.now/CVE-2024-31828): Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information…

- Severity: Medium 6.1
- Published: Apr 26, 2024
- Affected: versions 10.1.0.

### [CVE-2023-30124](https://cve.now/CVE-2023-30124): LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).

- Severity: Medium 5.4
- Published: May 18, 2023
- Affected: through 9.0.0.

### [CVE-2023-27238](https://cve.now/CVE-2023-27238): LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.

- Severity: Critical 9.8
- Published: May 12, 2023
- Affected: through 9.0.0.

### [CVE-2023-27237](https://cve.now/CVE-2023-27237): LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.

- Severity: Medium 6.1
- Published: May 12, 2023
- Affected: through 9.0.0.

### [CVE-2022-42188](https://cve.now/CVE-2022-42188): In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.

- Severity: High 7.5
- Published: Oct 18, 2022
- Affected: versions 9.0.0.

### [CVE-2020-23234](https://cve.now/CVE-2020-23234): Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML…

- Severity: Unrated
- Published: Jul 26, 2021
- Affected: through 5.8.0.

### [CVE-2020-23700](https://cve.now/CVE-2020-23700): Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.

- Severity: Unrated
- Published: Jul 7, 2021
- Affected: through 5.8.0.

### [CVE-2020-36397](https://cve.now/CVE-2020-36397): A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers…

- Severity: Unrated
- Published: Jul 2, 2021
- Affected: through 5.8.0.

### [CVE-2020-36396](https://cve.now/CVE-2020-36396): A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to…

- Severity: Unrated
- Published: Jul 2, 2021
- Affected: through 5.8.0.

### [CVE-2020-36395](https://cve.now/CVE-2020-36395): A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to…

- Severity: Unrated
- Published: Jul 2, 2021
- Affected: fixed in 5.8.0.

### [CVE-2020-28124](https://cve.now/CVE-2020-28124): Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.

- Severity: Unrated
- Published: Apr 14, 2021
- Affected: fixed in 7.0.1.

### [CVE-2018-16551](https://cve.now/CVE-2018-16551): LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.

- Severity: Unrated
- Published: Sep 5, 2018
- Affected: all versions.

### [CVE-2017-1000467](https://cve.now/CVE-2017-1000467): LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in…

- Severity: Unrated
- Published: Jan 3, 2018
- Affected: through 5.2.4.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/lavalite/cms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.