---
id: CVE-2025-51684
title: CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS)
summary: >-
  CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The
  application does not sanitize untrusted data received via window.postMessage
  before injecting it into the page DOM. An attacker can craft a malicious
  message that…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-07-30'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T16:04:24.933'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-51684'
references:
  - url: 'https://github.com/CleverTap/clevertap-web-sdk/issues/416'
    label: cve@mitre.org
  - url: 'https://github.com/CleverTap/clevertap-web-sdk/issues/416'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00261
epssPercentile: 0.15882
ingestedAt: '2026-09-09T16:14:05.511Z'
---

## Overview

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of arbitrary JavaScript in the context of the hosting site.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.