Foxit PDF Editor Cloud allows a user to create a new layer with unsanitized input that is stored and later rendered as part of the document’s HTML. When an unsuspecting user opens a document containing the malicious layer, the script executes in their browser, providing the attacker with the ability to run arbitrary JavaScript, steal session cookies, or perform further actions in the user’s context. This stored cross‑site scripting flaw is a classic input validation weakness (CWE‑79).

The vulnerability exists in Foxit Software Inc.’s PDF Editor Cloud service (pdfonline) for all releases prior to 2026‑02‑03. No later versions are impacted.

With a CVSS base score of 6.3 and an EPSS below 1 %, the likelihood of exploitation in the wild is low, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog. The flaw is typically triggered when a user creates a malicious layer that is later viewed by an attacker or other users, so the attack vector is via the web interface of the service. Although its impact is limited to the victim’s browser session, successful exploitation could lead to credential theft, data exfiltration, or defacement of shared documents.