Kentico Xperience Stored Cross-Site Scripting Vulnerability via Malicious XML File Uploads

A stored cross-site scripting vulnerability exists in Kentico Xperience versions through 13.0.56. This vulnerability allows authenticated users to inject malicious scripts by uploading harmful XML files as page attachments or metafiles. The injected scripts are executed in the browsers of users who access the affected pages.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user’s browser.

Remediation

Users can upgrade to Kentico Xperience version 13.0.57 or later, where this vulnerability has been addressed. Instructions for applying hotfixes are available on the Kentico Xperience documentation site.