Kentico Xperience Reflected Cross-Site Scripting Vulnerability in Page Preview

A reflected cross-site scripting vulnerability has been identified in Kentico Xperience versions through 13.0.109. This vulnerability allows authenticated users to inject malicious scripts via page preview URLs. Exploitation of this issue enables the execution of arbitrary scripts in the browsers of users interacting with the page preview.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.

Remediation

Users can upgrade to Kentico Xperience version 13.0.110 or later, where this vulnerability has been addressed. Instructions for applying hotfixes are available on the Kentico Xperience DevNet hotfixes page.