Kentico Xperience Stored Cross-Site Scripting Vulnerability in Form Configuration

A stored cross-site scripting vulnerability has been identified in Kentico Xperience versions through 13.0.74. This vulnerability allows attackers to inject malicious scripts into form redirect URL configurations. The injected scripts can then execute in the browsers of users who interact with the affected forms, exploiting the unvalidated configuration settings.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can upgrade to Kentico Xperience version 13.0.75 or later, where this vulnerability has been addressed. Instructions for applying the hotfix can be found on the Kentico Xperience DevNet hotfixes page.