What is GHSA-72f8-2pfx-xx29?

GHSA-72f8-2pfx-xx29 is a security advisory published by GitHub Security Advisories with Medium severity. CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not...

Which CVE IDs does GHSA-72f8-2pfx-xx29 cover?

GHSA-72f8-2pfx-xx29 covers the following CVE IDs: CVE-2025-51684. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-72f8-2pfx-xx29?

GHSA-72f8-2pfx-xx29 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-72f8-2pfx-xx29MediumCVSS 6.1

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not...

Vendor

GitHub Security Advisories

Published

July 30, 2026

Last Modified

July 31, 2026

🔗 CVE IDs covered (1)

CVE-2025-51684 →

📋 Description

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of arbitrary JavaScript in the context of the hosting site.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2025-51684
https://github.com/CleverTap/clevertap-web-sdk/issues/416
https://github.com/advisories/GHSA-72f8-2pfx-xx29