Foxit PDF Editor Cloud Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Digital IDs feature of Foxit PDF Editor Cloud. The issue arises because the application fails to properly sanitize the Common Name field in Digital IDs before adding user-supplied content to the Document Object Model (DOM). This lack of proper encoding allows embedded HTML or JavaScript to execute when the Digital IDs dialog is opened or when the affected PDF is viewed.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the context of the user.

Remediation

Users can update to the latest version of Foxit PDF Editor Cloud, which includes security and stability enhancements. No action is needed for those already using the updated version.