Kentico Xperience Stored Cross-Site Scripting Vulnerability in Rich Text Editor Component

A stored cross-site scripting vulnerability has been identified in Kentico Xperience versions through 13.0.162. This vulnerability allows attackers to inject malicious scripts via the rich text editor component used in page and form builders. Exploitation involves entering harmful URIs, which could enable the execution of malicious scripts in the browsers of users.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can apply the latest hotfix available for their Kentico Xperience version. Instructions for applying hotfixes can be found in the Kentico Xperience Documentation.