Security advisory: IBEXA-SA-2025-003

This security advisory resolves XSS vulnerabilities in several parts of the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

The Code Block in Page Builder is a special case. It's designed to accept any HTML, which includes embedded JavaScript. This means that XSS necessarily remains possible in the Code Block. As site administrator you should be aware of this when giving editors access to the Page Builder features, and limit that access only to highly trusted editors. It is possible to limit access to specific blocks per content type, where you can define which page blocks are available to an editor. Please see the documentation:
https://doc.ibexa.co/projects/userguide/en/4.6/content_management/configure_ct_field_settings/#default-configuration-of-pages

These are the affected areas of the back office:
Search in the dropdown
Search autocomplete 
User name in Creator filter (Trash and Search) and Reviewer input
Content type filter in search
Keyword field type 
Relation list field type 
Embed and embed inline in the Rich Text editor
Translation modal - language dropdown -> from the content tree
Categories/Tags tag view select
Submission in the form
Create product type - attribute name
Catalog - Code filter 
Catalog - Product lists - product name 
Generate variant - attribute input 
Targeting block in Page Builder
Code block in Page Builder (see important notes above)
Product collection block in Page Builder
Site factory form - Domain name field
Site factory form - Language field
Dashboard - Products by category block
Discounts promotion label/description in the storefront
Shipments list 
Product - eCommerce tab in Price management (v3.x Ibexa Commerce)