Public catalogue

MODX security advisories

Known, publicly disclosed vulnerabilities we track across MODX Revolution releases. Each advisory links to the release where it was fixed and the versions it affects.

Start free trial MODX versions

Disclosed advisories: 70
High or critical: 26
With CVE identifier: 42
Latest disclosure: July 21, 2026

				Versions
MODX Revolution 2.x improper input validation Improper Input Validation	CRITICAL	—	July 21, 2026	Fixed in 2.8.9-pl Since unknown
Type Improper Input Validation Fixed in MODX 2.8.9-pl Since Exact version not known Disclosed July 21, 2026 MODX Revolution 2.x (core) has insufficient input validation that can allow injection of arbitrary content into site templates. Depending on site configuration, impact may escalate to remote code execution. The issue has been present for an extended period and was identified during an internal security review. CVE and CVSS are pending. Technical detail (attack vector, affected configuration criteria, and proof-of-concept) is withheld until patch adoption is broad enough for responsible full disclosure. All 2.8.x installations should upgrade; exposure cannot be reliably self-assessed from this preliminary advisory alone. Remediation: Upgrade MODX Revolution 2.x to 2.8.9-pl or newer as soon as possible. MODX Cloud customers: infrastructure-level mitigations reduce risk during upgrade but do not replace patching your site. SiteDash Client v1.9 also includes an additional mitigation.
MODX Revolution 3.x improper input validation Improper Input Validation	CRITICAL	—	July 21, 2026	Fixed in 3.2.3-pl Since 3.0.0-alpha1
Type Improper Input Validation Fixed in MODX 3.2.3-pl Since MODX 3.0.0-alpha1 Disclosed July 21, 2026 MODX Revolution 3.x (core) has insufficient input validation that can allow injection of arbitrary content into site templates. Depending on site configuration, impact may escalate to remote code execution. The issue has been present for an extended period and was identified during an internal security review. CVE and CVSS are pending. Technical detail (attack vector, affected configuration criteria, and proof-of-concept) is withheld until patch adoption is broad enough for responsible full disclosure. All 3.x installations should upgrade; exposure cannot be reliably self-assessed from this preliminary advisory alone. Remediation: Upgrade MODX Revolution 3.x to 3.2.3-pl or newer as soon as possible. MODX Cloud customers: infrastructure-level mitigations reduce risk during upgrade but do not replace patching your site. SiteDash Client v1.9 also includes an additional mitigation.
A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure... XXE	CRITICAL	CVE-2020-25911	October 31, 2021	Fixed in 2.8.0-pl Since unknown
CVE CVE-2020-25911 Type XXE Fixed in MODX 2.8.0-pl Since Exact version not known Disclosed October 31, 2021 A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS). Remediation: Upgrade MODX Revolution to 2.8.0-pl or newer.
MODX Revolution exposure of sensitive user fields to authorized managers (#15678) Security	HIGH	—	April 28, 2021	Fixed in 2.8.2-pl Since unknown
Type Security Fixed in MODX 2.8.2-pl Since Exact version not known Disclosed April 28, 2021 MODX Revolution before 2.8.2-pl could return hashed passwords, cachepwd, salt, or session IDs to manager users with permission to manage users (#15678), including via security/group/user/getList and similar processor responses (SEC-3837). Requires an already-privileged manager account. Remediation: Upgrade MODX Revolution to 2.8.2-pl or newer.
Active exploit via exposed MODX Revolution setup/ directory Site Exploit	CRITICAL	—	April 1, 2019	Fixed in 2.7.1-pl Since unknown
Type Site Exploit Fixed in MODX 2.7.1-pl Since Exact version not known Disclosed April 1, 2019 There is an active exploit of sites that leave the MODX Revolution setup/ directory in place after installation. Anyone on the internet can use the installation utility to re-install MODX against an attacker-controlled database, gain Manager access, and use the file manager to upload back doors—potentially leading to full server compromise (rootkits, spam relays, crypto miners). Affected installations are those with setup/ still web-accessible (commonly reported for sites on MODX Revolution 2.7.0 and earlier, but any version with an intact setup/ directory is at risk). Check by visiting https://yoursite.example/setup/; if the MODX installer appears, remove the directory immediately via FTP or SSH. Remediation: Remove the setup/ directory from the web root immediately if it is still present. Upgrading alone does not remove this exposure. After removal, verify https://yoursite.example/setup/ no longer serves the installer.
setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to t... Security	CRITICAL	CVE-2017-7321	March 30, 2017	Fixed in 2.5.5-pl Since unknown
CVE CVE-2017-7321 Type Security Fixed in MODX 2.5.5-pl Since Exact version not known Disclosed March 30, 2017 setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to the setup/index.php?action=welcome URI. Remediation: Upgrade MODX Revolution to 2.5.5-pl or newer.
setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter. Security	CRITICAL	CVE-2017-7324	March 30, 2017	Fixed in 2.5.5-pl Since unknown
CVE CVE-2017-7324 Type Security Fixed in MODX 2.5.5-pl Since Exact version not known Disclosed March 30, 2017 setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter. Remediation: Upgrade MODX Revolution to 2.5.5-pl or newer.
MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable... Security	HIGH	CVE-2022-26149	February 26, 2022	Fixed in 2.8.4-pl Since unknown
CVE CVE-2022-26149 Type Security Fixed in MODX 2.8.4-pl Since Exact version not known Disclosed February 26, 2022 MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator. Remediation: Upgrade MODX Revolution to 2.8.4-pl or newer.
MODX Revolution file management not restricted to allowed file types (#15643) Access Control	HIGH	—	April 28, 2021	Fixed in 2.8.2-pl Since unknown
Type Access Control Fixed in MODX 2.8.2-pl Since Exact version not known Disclosed April 28, 2021 MODX Revolution before 2.8.2-pl limits create and upload actions to allowed file types but did not consistently enforce those limits on other file manager actions, notably editing existing files. A manager user could edit disallowed types such as PHP, reported as a potential remote code execution vector (SEC-3837). Remediation: Upgrade MODX Revolution to 2.8.2-pl or newer.
MODX Revolution path traversal when sending registry message (#15134) Directory Traversal	MEDIUM	—	October 6, 2020	Fixed in 2.8.0-pl Since unknown
Type Directory Traversal Fixed in MODX 2.8.0-pl Since Exact version not known Disclosed October 6, 2020 MODX Revolution before 2.8.0-pl allowed path traversal in the code path that sends registry messages (#15134). Unlikely exploit target beyond annoyance, requiring manager permissions. Remediation: Upgrade MODX Revolution to 2.8.0-pl or newer.
MODX Revolution version <=2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can result in remove files.... Directory Traversal	HIGH	CVE-2018-1000208	July 13, 2018	Fixed in 2.6.5-pl Since unknown
CVE CVE-2018-1000208 Type Directory Traversal Fixed in MODX 2.6.5-pl Since Exact version not known Disclosed July 13, 2018 MODX Revolution version <=2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can result in remove files. This attack appear to be exploitable via web request via security/login processor. This vulnerability appears to have been fixed in pull 13980. Remediation: Upgrade MODX Revolution to 2.6.5-pl or newer.
MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that c... Access Control	HIGH	CVE-2018-1000207	July 13, 2018	Fixed in 2.6.5-pl Since unknown
CVE CVE-2018-1000207 Type Access Control Fixed in MODX 2.6.5-pl Since Exact version not known Disclosed July 13, 2018 MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68. Remediation: Upgrade MODX Revolution to 2.6.5-pl or newer.
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user... SQL Injection	HIGH	CVE-2017-1000067	July 17, 2017	Fixed in 2.5.7-pl Since unknown
CVE CVE-2017-1000067 Type SQL Injection Fixed in MODX 2.5.7-pl Since Exact version not known Disclosed July 17, 2017 MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges. Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.
In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess. Security	HIGH	CVE-2017-9069	May 18, 2017	Fixed in 2.5.7-pl Since unknown
CVE CVE-2017-9069 Type Security Fixed in MODX 2.5.7-pl Since Exact version not known Disclosed May 18, 2017 In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess. Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.
In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient val... Directory Traversal	HIGH	CVE-2017-9067	May 18, 2017	Fixed in 2.5.7-pl Since unknown
CVE CVE-2017-9067 Type Directory Traversal Fixed in MODX 2.5.7-pl Since Exact version not known Disclosed May 18, 2017 In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal. Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.
MODX Revolution LFI protections on Windows (#13428) Directory Traversal	HIGH	—	April 20, 2017	Fixed in 2.5.7-pl Since unknown
Type Directory Traversal Fixed in MODX 2.5.7-pl Since Exact version not known Disclosed April 20, 2017 MODX Revolution 2.5.7-pl fixes local file inclusion preventions to Windows hosts (#13428). Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.
The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows ... Security	HIGH	CVE-2017-7322	March 30, 2017	Fixed in 2.5.5-pl Since unknown
CVE CVE-2017-7322 Type Security Fixed in MODX 2.5.5-pl Since Exact version not known Disclosed March 30, 2017 The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code via a crafted certificate. Remediation: Upgrade MODX Revolution to 2.5.5-pl or newer.
The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier use http://rest.modx.com by default, which allows man-in-the-mid... Security	HIGH	CVE-2017-7323	March 30, 2017	Fixed in 2.5.5-pl Since unknown
CVE CVE-2017-7323 Type Security Fixed in MODX 2.5.5-pl Since Exact version not known Disclosed March 30, 2017 The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier use http://rest.modx.com by default, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code by leveraging the lack of the HTTPS protection mechanism. Remediation: Upgrade MODX Revolution to 2.5.5-pl or newer.
MODX Revolution missing processor permission checks (#13174) Access Control	MEDIUM	—	January 3, 2017	Fixed in 2.5.3-pl Since unknown
Type Access Control Fixed in MODX 2.5.3-pl Since Exact version not known Disclosed January 3, 2017 MODX Revolution before 2.5.3-pl various missing permission checks to processors (#13174), allowing users to access elements or perform actions they shouldn't have access to while still requiring admin access. By itself, fairly harmless, but could compound with other vulnerabilities. Remediation: Upgrade MODX Revolution to 2.5.3-pl or newer.
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulatio... Directory Traversal	HIGH	CVE-2016-10039	December 24, 2016	Fixed in 2.5.2-pl Since unknown
CVE CVE-2016-10039 Type Directory Traversal Fixed in MODX 2.5.2-pl Since Exact version not known Disclosed December 24, 2016 Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/getfiles. Remediation: Upgrade MODX Revolution to 2.5.2-pl or newer.
MODX Revolution path traversal in modConnectorResponse action param (#13173) Directory Traversal	MEDIUM	—	November 14, 2016	Fixed in 2.5.2-pl Since unknown
Type Directory Traversal Fixed in MODX 2.5.2-pl Since Exact version not known Disclosed November 14, 2016 MODX Revolution before 2.5.2-pl allowed path traversal via the action parameter in modConnectorResponse (#13173), which could let users reach processors outside the intended location. Remediation: Upgrade MODX Revolution to 2.5.2-pl or newer.
MODX Revolution SQL injection fix (changelog #13052) SQL Injection	MEDIUM	—	July 21, 2016	Fixed in 2.5.1-pl Since unknown
Type SQL Injection Fixed in MODX 2.5.1-pl Since Exact version not known Disclosed July 21, 2016 MODX Revolution 2.5.1-pl fixed an SQL injection issue in the resource/getNodes processor, requiring admin access to exploit. [#13052] Remediation: Upgrade MODX Revolution to 2.5.1-pl or newer.
Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPS... SQL Injection	HIGH	CVE-2014-2736	April 24, 2014	Fixed in 2.3.1-pl Since unknown
CVE CVE-2014-2736 Type SQL Injection Fixed in MODX 2.3.1-pl Since Exact version not known Disclosed April 24, 2014 Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPSESSID) to index.php or remote authenticated users to execute arbitrary SQL commands via the (2) user parameter to connectors/security/message.php or (3) id parameter to manager/index.php. Remediation: Upgrade MODX Revolution to 2.3.1-pl or newer.
SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecifie... SQL Injection	HIGH	CVE-2014-2311	March 11, 2014	Fixed in 2.3.0-pl Since unknown
CVE CVE-2014-2311 Type SQL Injection Fixed in MODX 2.3.0-pl Since Exact version not known Disclosed March 11, 2014 SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Remediation: Upgrade MODX Revolution to 2.3.0-pl or newer.
MODX Revolution class-loading LFI in registerLogging (changelog #10043) Directory Traversal	HIGH	—	August 28, 2013	Fixed in 2.2.9-pl Since unknown
Type Directory Traversal Fixed in MODX 2.2.9-pl Since Exact version not known Disclosed August 28, 2013 MODX Revolution 2.2.9-pl fixed class-loading local file inclusion in registerLogging (#10043). Remediation: Upgrade MODX Revolution to 2.2.9-pl or newer.
MODX Revolution SQL injection in modImport (changelog #10070) SQL Injection	HIGH	—	August 28, 2013	Fixed in 2.2.9-pl Since unknown
Type SQL Injection Fixed in MODX 2.2.9-pl Since Exact version not known Disclosed August 28, 2013 MODX Revolution 2.2.9-pl addressed a potential SQL injection vulnerability in modImport (#10070). Remediation: Upgrade MODX Revolution to 2.2.9-pl or newer.
MODX Revolution 3.x various security patches ported from 2.x (#15843) Security	MEDIUM	—	October 27, 2021	Fixed in 3.0.0-alpha3 Since 3.0.0-alpha1
Type Security Fixed in MODX 3.0.0-alpha3 Since MODX 3.0.0-alpha1 Disclosed October 27, 2021 MODX Revolution 3.0.0-alpha3 includes ports for various security patches in the 2.8.0 and 2.8.2 releases, including #15720 (various XSS), #15678 (unauthorized access to user information), #15643 (disallow editing/removing files to extensions that are not allowed), #15280 (XSS in resourcelist tv), and XSS in resource data view, tree, and media browser #15273. Remediation: Upgrade MODX Revolution 3.x to 3.0.0-alpha3 or newer.
MODX Revolution MODx.config XSSI hardening (#15644) Security	MEDIUM	—	October 27, 2021	Fixed in 2.8.2-pl Since unknown
Type Security Fixed in MODX 2.8.2-pl Since Exact version not known Disclosed October 27, 2021 MODX Revolution 2.8.2 requires an auth token to access MODx.config to prevent cross-site script inclusion (XSSI) (#15644). This flaw allowed attackers to load the MODx.config data if users were logged in to the manager, without requiring access to the session token, potentially leaking configuration paths or information. MODx.config was already filtering passwords and known-sensitive information. Remediation: Upgrade MODX Revolution to 2.8.2 or newer.
MODX Revolution MODx.config XSSI hardening (#15645) Security	MEDIUM	—	October 27, 2021	Fixed in 3.0.0-alpha3 Since 3.0.0-alpha1
Type Security Fixed in MODX 3.0.0-alpha3 Since MODX 3.0.0-alpha1 Disclosed October 27, 2021 MODX Revolution 3.0.0-alpha3 requires an auth token to access MODx.config to prevent cross-site script inclusion (XSSI) (#15645). This flaw allowed attackers to load the MODx.config data if users were logged in to the manager, without requiring access to the session token, potentially leaking configuration paths or information. MODx.config was already filtering passwords and known-sensitive information. Remediation: Upgrade MODX Revolution 3.x to 3.0.0-alpha3 or newer (prefer current stable 3.x).
MODX Revolution reflected XSS vulnerabilities (#15720) XSS	MEDIUM	—	May 28, 2021	Fixed in 2.8.3-pl Since unknown
Type XSS Fixed in MODX 2.8.3-pl Since Exact version not known Disclosed May 28, 2021 MODX Revolution 2.8.3-pl fixes a number of reported reflected XSS vulnerabilities in the manager, requiring manager permissions. Remediation: Upgrade MODX Revolution to 2.8.3-pl or newer.
MODX Revolution XSS in resource list template variable (changelog #15280) XSS	LOW	—	October 22, 2020	Fixed in 2.8.1-pl Since unknown
Type XSS Fixed in MODX 2.8.1-pl Since Exact version not known Disclosed October 22, 2020 MODX Revolution before 2.8.1-pl had cross-site scripting issues in the resource list template variable UI, requiring permission to edit resource groups to exploit. Remediation: Upgrade MODX Revolution to 2.8.1-pl or newer.
MODX Revolution stored XSS in the manager (changelog #15273) XSS	LOW	—	October 6, 2020	Fixed in 2.8.0-pl Since unknown
Type XSS Fixed in MODX 2.8.0-pl Since Exact version not known Disclosed October 6, 2020 MODX Revolution before 2.8.0-pl had multiple stored cross-site scripting (XSS) issues in the manager interface. Low level risk due to requiring manager access with permission to edit resources or upload files. Resource group name, media browser file names, resource pagetitle, resource oveview. Remediation: Upgrade MODX Revolution to 2.8.0-pl or newer.
MODX Revolution XSS in file upload and file tree (#15262) XSS	MEDIUM	—	October 6, 2020	Fixed in 2.8.0-pl Since unknown
Type XSS Fixed in MODX 2.8.0-pl Since Exact version not known Disclosed October 6, 2020 MODX Revolution before 2.8.0-pl was vulnerable to cross-site scripting (XSS) via the file upload flow (reflected self-xss) and file tree in the manager (stored XSS) requiring manager access. Remediation: Upgrade MODX Revolution to 2.8.0-pl or newer.
MODX Revolution XSS in TV template access grid (changelog #15142) XSS	MEDIUM	—	October 6, 2020	Fixed in 2.8.0-pl Since unknown
Type XSS Fixed in MODX 2.8.0-pl Since Exact version not known Disclosed October 6, 2020 MODX Revolution before 2.8.0-pl had an XSS issue involving template names shown in the template variable template access grid. Remediation: Upgrade MODX Revolution to 2.8.0-pl or newer.
MODX Revolution XSS via template name (changelog #15137) XSS	MEDIUM	—	October 6, 2020	Fixed in 2.8.0-pl Since unknown
Type XSS Fixed in MODX 2.8.0-pl Since Exact version not known Disclosed October 6, 2020 MODX Revolution before 2.8.0-pl did not properly neutralize template names in the manager, allowing stored or reflected XSS in some views. Remediation: Upgrade MODX Revolution to 2.8.0-pl or newer.
MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, o... XSS	MEDIUM	CVE-2018-20756	February 6, 2019	Fixed in 2.7.1-pl Since unknown
CVE CVE-2018-20756 Type XSS Fixed in MODX 2.7.1-pl Since Exact version not known Disclosed February 6, 2019 MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs. Remediation: Upgrade MODX Revolution to 2.7.1-pl or newer.
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name. XSS	MEDIUM	CVE-2018-20757	February 6, 2019	Fixed in 2.7.1-pl Since unknown
CVE CVE-2018-20757 Type XSS Fixed in MODX 2.7.1-pl Since Exact version not known Disclosed February 6, 2019 MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name. Remediation: Upgrade MODX Revolution to 2.7.1-pl or newer.
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field. XSS	MEDIUM	CVE-2018-20755	February 6, 2019	Fixed in 2.7.1-pl Since unknown
CVE CVE-2018-20755 Type XSS Fixed in MODX 2.7.1-pl Since Exact version not known Disclosed February 6, 2019 MODX Revolution through v2.7.0-pl allows XSS via the User Photo field. Remediation: Upgrade MODX Revolution to 2.7.1-pl or newer.
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description. XSS	MEDIUM	CVE-2018-20758	February 6, 2019	Fixed in 2.7.1-pl Since unknown
CVE CVE-2018-20758 Type XSS Fixed in MODX 2.7.1-pl Since Exact version not known Disclosed February 6, 2019 MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description. Remediation: Upgrade MODX Revolution to 2.7.1-pl or newer.
MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action. XSS	MEDIUM	CVE-2018-17556	September 26, 2018	Fixed in 2.7.0-pl Since unknown
CVE CVE-2018-17556 Type XSS Fixed in MODX 2.7.0-pl Since Exact version not known Disclosed September 26, 2018 MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action. Remediation: Upgrade MODX Revolution to 2.7.0-pl or newer.
MODX Revolution 2.6.3 has XSS. XSS	MEDIUM	CVE-2018-10382	June 1, 2018	Fixed in 2.6.4-pl Since unknown
CVE CVE-2018-10382 Type XSS Fixed in MODX 2.6.4-pl Since Exact version not known Disclosed June 1, 2018 MODX Revolution 2.6.3 has XSS. Remediation: Upgrade MODX Revolution to 2.6.4-pl or newer.
A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permiss... XSS	MEDIUM	CVE-2017-1000223	November 17, 2017	Fixed in 2.5.7-pl Since unknown
CVE CVE-2017-1000223 Type XSS Fixed in MODX 2.5.7-pl Since Exact version not known Disclosed November 17, 2017 A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an escalation of privileges providing complete administrative control over the CMS. Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.
Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via... XSS	MEDIUM	CVE-2015-6588	August 29, 2017	Fixed in 2.0.0-alpha-3 Since unknown
CVE CVE-2015-6588 Type XSS Fixed in MODX 2.0.0-alpha-3 Since Exact version not known Disclosed August 29, 2017 Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING. Remediation: Upgrade MODX Revolution to 2.0.0-alpha-3 or newer.
In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.p... XSS	MEDIUM	CVE-2017-11744	July 30, 2017	Fixed in 2.6.0-pl Since unknown
CVE CVE-2017-11744 Type XSS Fixed in MODX 2.6.0-pl Since Exact version not known Disclosed July 30, 2017 In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.php will be triggered by every user, when they visit this module. Remediation: Upgrade MODX Revolution to 2.6.0-pl or newer.
In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to co... XSS	MEDIUM	CVE-2017-9070	May 18, 2017	Fixed in 2.5.7-pl Since unknown
CVE CVE-2017-9070 Type XSS Fixed in MODX 2.5.7-pl Since Exact version not known Disclosed May 18, 2017 In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php. Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.
In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by... XSS	MEDIUM	CVE-2017-9068	May 18, 2017	Fixed in 2.5.7-pl Since unknown
CVE CVE-2017-9068 Type XSS Fixed in MODX 2.5.7-pl Since Exact version not known Disclosed May 18, 2017 In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the database_type parameter. Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.
In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable ... XSS	MEDIUM	CVE-2017-9071	May 18, 2017	Fixed in 2.5.7-pl Since unknown
CVE CVE-2017-9071 Type XSS Fixed in MODX 2.5.7-pl Since Exact version not known Disclosed May 18, 2017 In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning. Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.
Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to ... Directory Traversal	MEDIUM	CVE-2017-8115	April 25, 2017	Fixed in 2.6.0-pl Since unknown
CVE CVE-2017-8115 Type Directory Traversal Fixed in MODX 2.6.0-pl Since Exact version not known Disclosed April 25, 2017 Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information. Remediation: Upgrade MODX Revolution to 2.6.0-pl or newer.
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to c... XSS	MEDIUM	CVE-2017-7320	March 30, 2017	Fixed in 2.5.5-pl Since unknown
CVE CVE-2017-7320 Type XSS Fixed in MODX 2.5.5-pl Since Exact version not known Disclosed March 30, 2017 setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion), or conduct HTTP Response Splitting attacks with resultant XSS, via an invalid parameter value. Remediation: Upgrade MODX Revolution to 2.5.5-pl or newer.
MODX Revolution XSS in template description (#13290) XSS	MEDIUM	—	March 28, 2017	Fixed in 2.5.6-pl Since unknown
Type XSS Fixed in MODX 2.5.6-pl Since Exact version not known Disclosed March 28, 2017 MODX Revolution 2.5.6-pl fixes missing HTML encoding in template descriptions to prevent potential XSS (#13290). XSS affecting users with the ability to edit templates in the manager. Remediation: Upgrade MODX Revolution to 2.5.6-pl or newer.
MODX Revolution reflected XSS in connector JSONP (changelog #13051) XSS	MEDIUM	—	July 21, 2016	Fixed in 2.5.1-pl Since unknown
Type XSS Fixed in MODX 2.5.1-pl Since Exact version not known Disclosed July 21, 2016 MODX Revolution before 2.5.1-pl allowed reflected cross-site scripting via the connector JSONP support. Remediation: Upgrade MODX Revolution to 2.5.1-pl or newer.
MODX Revolution XSS in file create/update processors (changelog #12513) XSS	MEDIUM	—	August 18, 2015	Fixed in 2.4.0-pl Since unknown
Type XSS Fixed in MODX 2.4.0-pl Since Exact version not known Disclosed August 18, 2015 XSS in file create/update processors. Remediation: Upgrade MODX Revolution to 2.4.0-pl or newer.
Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbi... XSS	MEDIUM	CVE-2014-8992	December 22, 2014	Fixed in 2.3.3-pl Since unknown
CVE CVE-2014-8992 Type XSS Fixed in MODX 2.3.3-pl Since Exact version not known Disclosed December 22, 2014 Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter. Remediation: Upgrade MODX Revolution to 2.3.3-pl or newer.
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attacker... Security	MEDIUM	CVE-2014-8775	December 3, 2014	Fixed in 2.3.0-pl Since unknown
CVE CVE-2014-8775 Type Security Fixed in MODX 2.3.0-pl Since Exact version not known Disclosed December 3, 2014 MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. Remediation: Upgrade MODX Revolution to 2.3.0-pl or newer.
Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or ... XSS	MEDIUM	CVE-2014-8774	December 3, 2014	Fixed in 2.3.0-pl Since unknown
CVE CVE-2014-8774 Type XSS Fixed in MODX 2.3.0-pl Since Exact version not known Disclosed December 3, 2014 Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the context_key parameter. Remediation: Upgrade MODX Revolution to 2.3.0-pl or newer.
MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token... CSRF	MEDIUM	CVE-2014-8773	December 3, 2014	Fixed in 2.3.0-pl Since unknown
CVE CVE-2014-8773 Type CSRF Fixed in MODX 2.3.0-pl Since Exact version not known Disclosed December 3, 2014 MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token or via a (2) long string in the CSRF token parameter. Remediation: Upgrade MODX Revolution to 2.3.0-pl or newer.
Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject ar... XSS	MEDIUM	CVE-2014-5451	November 6, 2014	Fixed in 2.3.2-pl Since unknown
CVE CVE-2014-5451 Type XSS Fixed in MODX 2.3.2-pl Since Exact version not known Disclosed November 6, 2014 Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression. Remediation: Upgrade MODX Revolution to 2.3.2-pl or newer.
Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary... XSS	MEDIUM	CVE-2014-2080	March 1, 2014	Fixed in 2.3.0-pl Since unknown
CVE CVE-2014-2080 Type XSS Fixed in MODX 2.3.0-pl Since Exact version not known Disclosed March 1, 2014 Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter. Remediation: Upgrade MODX Revolution to 2.3.0-pl or newer.
MODX Revolution XSS in user messaging (changelog #6937) XSS	MEDIUM	—	August 28, 2013	Fixed in 2.2.9-pl Since unknown
Type XSS Fixed in MODX 2.2.9-pl Since Exact version not known Disclosed August 28, 2013 MODX Revolution 2.2.9-pl fixed persistent and reflected cross-site scripting in user messaging (#6937). Remediation: Upgrade MODX Revolution to 2.2.9-pl or newer.
MODX Revolution modX::stripTags script execution (changelog #9080) XSS	MEDIUM	—	December 3, 2012	Fixed in 2.2.6-pl Since unknown
Type XSS Fixed in MODX 2.2.6-pl Since Exact version not known Disclosed December 3, 2012 MODX Revolution 2.2.6-pl fixed a modX::stripTags() bug that could allow script execution (#9080). Output filtering bypass / inadequate sanitization. Remediation: Upgrade MODX Revolution to 2.2.6-pl or newer.
Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is... Directory Traversal	MEDIUM	CVE-2010-5278	October 7, 2012	Fixed in 2.0.3-pl Since unknown
CVE CVE-2010-5278 Type Directory Traversal Fixed in MODX 2.0.3-pl Since Exact version not known Disclosed October 7, 2012 Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter. NOTE: some of these details are obtained from third party information. Remediation: Upgrade MODX Revolution to 2.0.3-pl or newer.
MODX Revolution manager login XSS (changelog #2918) XSS	MEDIUM	—	December 8, 2010	Fixed in 2.0.5-pl Since unknown
Type XSS Fixed in MODX 2.0.5-pl Since Exact version not known Disclosed December 8, 2010 MODX Revolution before 2.0.5-pl fixed an XSS vulnerability in the manager login that allowed JavaScript injection ([#2918] per 2.0.5-pl changelog). Compare with CVE-2014-2311 and other early login XSS disclosures. Remediation: Upgrade MODX Revolution to 2.0.5-pl or newer.
MODX Revolution manager XSS stripping (MODX-2210) XSS	MEDIUM	—	September 16, 2010	Fixed in 2.0.1-pl Since unknown
Type XSS Fixed in MODX 2.0.1-pl Since Exact version not known Disclosed September 16, 2010 MODX Revolution 2.0.1-pl added XSS stripping for a manager variable ([#MODX-2210] per 2.0.1-pl changelog). Remediation: Upgrade MODX Revolution to 2.0.1-pl or newer.
Cross-site request forgery (CSRF) vulnerability in page 34 in MODx CMS 0.9.6.1 and 0.9.6.1p1 allows remote attackers to hijack the authentication of other us... CSRF	MEDIUM	CVE-2008-7243	September 17, 2009	Fixed in 2.0.0-alpha-3 Since unknown
CVE CVE-2008-7243 Type CSRF Fixed in MODX 2.0.0-alpha-3 Since Exact version not known Disclosed September 17, 2009 Cross-site request forgery (CSRF) vulnerability in page 34 in MODx CMS 0.9.6.1 and 0.9.6.1p1 allows remote attackers to hijack the authentication of other users for requests that modify passwords via manager/index.php. NOTE: due to the lack of details, it is not clear whether this is related to CVE-2008-5941. Remediation: Upgrade MODX Revolution to 2.0.0-alpha-3 or newer.
Multiple cross-site scripting (XSS) vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the (1... XSS	MEDIUM	CVE-2008-7242	September 17, 2009	Fixed in 2.0.0-alpha-3 Since unknown
CVE CVE-2008-7242 Type XSS Fixed in MODX 2.0.0-alpha-3 Since Exact version not known Disclosed September 17, 2009 Multiple cross-site scripting (XSS) vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the (1) search, (2) "a," (3) messagesubject, and (4) messagebody parameters to certain pages as reachable from manager/index.php; (5) highlight, (6) id, (7) email, (8) name, and (9) parent parameters to index.php; and the (10) docgrp and (11) moreResultsPage parameters to index-ajax.php. Remediation: Upgrade MODX Revolution to 2.0.0-alpha-3 or newer.
Cross-site scripting (XSS) vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a Ja... XSS	MEDIUM	CVE-2008-5939	January 22, 2009	Fixed in 2.0.0-alpha-3 Since unknown
CVE CVE-2008-5939 Type XSS Fixed in MODX 2.0.0-alpha-3 Since Exact version not known Disclosed January 22, 2009 Cross-site scripting (XSS) vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected, but this is probably incorrect based on the original disclosure. Remediation: Upgrade MODX Revolution to 2.0.0-alpha-3 or newer.
PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magic_quotes_gpc is disabled, al... Security	MEDIUM	CVE-2008-5938	January 22, 2009	Fixed in 2.0.0-alpha-3 Since unknown
CVE CVE-2008-5938 Type Security Fixed in MODX 2.0.0-alpha-3 Since Exact version not known Disclosed January 22, 2009 PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the reflect_base parameter. Remediation: Upgrade MODX Revolution to 2.0.0-alpha-3 or newer.
PHP remote file inclusion vulnerability in manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php in Modx CMS 0.9.2.1 and earlier allows remote at... Security	MEDIUM	CVE-2006-5730	November 6, 2006	Fixed in 2.0.0-alpha-3 Since unknown
CVE CVE-2006-5730 Type Security Fixed in MODX 2.0.0-alpha-3 Since Exact version not known Disclosed November 6, 2006 PHP remote file inclusion vulnerability in manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php in Modx CMS 0.9.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter. NOTE: it is possible that this is a vulnerability in FCKeditor. Remediation: Upgrade MODX Revolution to 2.0.0-alpha-3 or newer.
MODX allows cross-site scripting (XSS) via an SVG file XSS	LOW	CVE-2025-28010	March 13, 2025	Fixed in 3.1.0-pl Since 3.0.0-alpha1
CVE CVE-2025-28010 Type XSS Fixed in MODX 3.1.0-pl Since MODX 3.0.0-alpha1 Disclosed March 13, 2025 A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image. Remediation: Upgrade MODX Revolution to 3.1.0-pl or newer.
Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via ... XSS	LOW	CVE-2010-4883	October 7, 2011	Fixed in 2.0.3-pl Since unknown
CVE CVE-2010-4883 Type XSS Fixed in MODX 2.0.3-pl Since Exact version not known Disclosed October 7, 2011 Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter. Remediation: Upgrade MODX Revolution to 2.0.3-pl or newer.
No matching advisories.

We're part of the MODX open source security team. Depending on each disclosure, that can mean preparing SiteDash updates (checks, vulnerability data, and tooling) before or as advisories go public, and proactively telling you what matters for your sites and how to respond. That helps you keep up when the threat landscape keeps moving.

All MODX versions

MODX security advisories

Browse advisories 70 total