Composer starcitizentools/citizen-skin has 9 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-47536 | starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field | medium | 4.6 | >=2.6.3 and <2.31.0 | 2.31.0 |
| CVE-2025-62508 | Citizen vulnerable to stored XSS in sticky header button messages | medium | 6.5 | >=3.3.0 and <3.9.0 | 3.9.0 |
| CVE-2025-49578 | starcitizentools/citizen-skin allows stored XSS in user registration date message | medium | 6.5 | >=3.3.0 and <3.3.1 | 3.3.1 |
| CVE-2025-49575 | Citizen skin vulnerable to stored XSS through multiple system messages | medium | 6.5 | >=2.4.2 and <3.3.1 | 3.3.1 |
| CVE-2025-49576 | starcitizentools/citizen-skin allows stored XSS in search no result messages | medium | 6.5 | >=2.31.0 and <3.3.1 | 3.3.1 |
| CVE-2025-49577 | starcitizentools/citizen-skin allows stored XSS in preference menu heading messages | medium | 6.5 | >=2.13.0 and <3.3.1 | 3.3.1 |
| CVE-2025-49579 | starcitizentools/citizen-skin allows stored XSS in menu heading message | medium | 6.5 | >=2.4.2 and <3.3.1 | 3.3.1 |
| CVE-2025-53370 | Citizen vulnerable to Stored XSS through short descriptions | high | 8.6 | >=1.9.4 and <3.4.0 | 3.4.0 |
| CVE-2025-53368 | starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions | high | 8.6 | >=1.9.4 and <3.4.0 | 3.4.0 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked