Kentico Xperience HTML Injection Vulnerability in Form Submission Emails

A vulnerability allowing HTML injection has been identified in Kentico Xperience versions through 13.0.71. This issue arises because unencoded form field values can be injected into emails generated from form submissions. Such unencoded values may be executed as HTML in the email clients of the recipients, potentially leading to a compromise of email security.

Impact

Exploitation of this vulnerability could allow for HTML content execution in the email clients of recipients, creating a risk of email security compromise.

Remediation

Users can apply the latest hotfix available for their Kentico Xperience version. Instructions for applying hotfixes can be found in the Kentico Xperience Documentation.