Kentico Xperience <= 13.0.88 Rich Text Editor Reflected XSS

Advisories

severity: medium
date: December 18, 2025
Affecting: Xperience <= 13.0.88
CVE: CVE-2022-50681
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References: Kentico DevNet Hotfixes
Credit: Kentico Security Team
Description: A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via administration input fields in the Rich text editor component. Attackers can exploit this vulnerability to execute arbitrary scripts in users' browsers.