Optimizely EPiServer.CMS.Core Stored Cross-Site Scripting Vulnerability

A high-severity stored cross-site scripting vulnerability has been identified in Optimizely EPiServer.CMS.Core versions prior to 12.22.0. This vulnerability allows malicious actors to inject and execute arbitrary JavaScript code within the CMS. The issue could lead to the compromise of user data, unauthorized privilege escalation, or execution of unauthorized actions. The vulnerability is present in several areas of the CMS, including content editing, link management, and file uploads.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user.