Kentico Xperience Stored Cross-Site Scripting Vulnerability in Shipping Options Configuration

A stored cross-site scripting vulnerability exists in Kentico Xperience versions through 13.0.158. This vulnerability allows attackers to inject malicious scripts into the shipping options configuration, which could be executed in the browsers of users, potentially leading to the theft of sensitive data.

Impact

Exploitation of this vulnerability could result in stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can apply the latest hotfix available for their Kentico Xperience version. Instructions for applying hotfixes can be found on the Kentico Xperience documentation website.