CVE-2018-20756: MODX Revolution allows XSS via document resources

May 14, 2022 (updated July 11, 2025)

MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs.

References

github.com/advisories/GHSA-fpxg-5x79-43rm
github.com/modxcms/revolution
github.com/modxcms/revolution/commit/71f894ee55dc4eed10538979761d6c94e8cd1078
github.com/modxcms/revolution/issues/14105
github.com/modxcms/revolution/pull/14335
nvd.nist.gov/vuln/detail/CVE-2018-20756

Code Behaviors & Features

Detect and mitigate CVE-2018-20756 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →