CVE-2025-5591
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user's session and perform actions in their security context.
Risk Assessment
An attacker can hijack a victim's session and perform actions on their behalf, potentially leading to unauthorized changes, data theft, or privilege escalation.
Recommendation
Update Kentico Xperience to a patched version or apply proper input validation filters in form components.
Other vulnerabilities in Kentico Xperience
See all- CVE-2025-2747CriticalActively exploited
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects. This issue affects Xperience through 13.0.178.
- CVE-2025-2746CriticalActively exploited
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects. This issue affects Xperience through 13.0.172.
- CVE-2026-105046Medium
Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.
- CVE-2020-36890High
An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege levels.
Original NVD description (English source)
Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS