Kentico Xperience Stored Cross-Site Scripting Vulnerability in Form Validation

A stored cross-site scripting vulnerability has been identified in Kentico Xperience versions through 13.0.159. This vulnerability allows attackers to inject malicious scripts into form validation rule configurations. Exploitation of this issue enables the injected scripts to be executed in the browsers of users accessing the affected application.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can upgrade to Kentico Xperience version 13.0.160 or later, where this vulnerability has been addressed. Instructions for applying hotfixes are available on the Kentico Xperience documentation site.