XSS in Nosto

CVE-2025-40726

Reflected Cross-Site Scripting (XSS) vulnerability in /pages/search-results-page in Nosto, which allows remote attackers to execute arbitrary code via the q GET request parameter.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.007 (49.5th percentile) — read the EPSS interpretation.

Affected products

  • Nosto — versions All versions

Weakness classification (CWE)

References