CVE-2025-70960: Tendenci CMS contains a stored Cross-site Scripting (XSS) vulnerability in the Forums module

February 3, 2026 (updated June 10, 2026)

A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

References

github.com/advisories/GHSA-6fvp-wmh6-jg95
github.com/emirhanyucelll/tendenci/blob/main/Readme.md
nvd.nist.gov/vuln/detail/CVE-2025-70960

Code Behaviors & Features

Detect and mitigate CVE-2025-70960 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →