Kentico Xperience Stored Cross-Site Scripting Vulnerability in Email Marketing Templates

A stored cross-site scripting vulnerability exists in Kentico Xperience versions through 13.0.92. This vulnerability allows administration users to inject malicious scripts into email marketing templates. Exploitation of this issue could lead to the execution of these scripts in user browsers, potentially compromising user information.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can upgrade to Kentico Xperience version 13.0.93 or later, where this vulnerability has been addressed. Instructions for applying the hotfix are available on the Kentico Xperience DevNet hotfixes page.