Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data

Description

An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).

Recommendation

Update the bootstrap-multiselect package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-gv5r-9gxr-v74w
• CVE-2025-47204
• CWE-352
• CWE-79
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Fiora chat group avatar is vulnerable to XSS via SVG files - CVE-2025-56515
• Quill is vulnerable to XSS via HTML export feature - CVE-2025-15056
• jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin - CVE-2025-9910
• MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server - CVE-2025-58444

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

Tags:

npm

bootstrap-multiselect