Kentico Xperience Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Kentico Xperience version 13 prior to 13.0.167. This issue allows attackers to inject malicious scripts via a form component, which can hijack the session of a victim user and enable the attacker to perform actions on behalf of the user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users are advised to change Kentico's default configuration according to the vendor's advisory.