CVE-2025-5591

Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.

Score

CVSS 4.0 7.7 High

Status

Analyzed - vdp@themissinglink.com.au

Published

2026-01-05

Last modified

2026-10-07

Weaknesses

CWE-1188, CWE-79

Affected products

• Kentico Xperience (Kentico)
• Xperience (Kentico)

References

• https://www.themissinglink.com.au/security-advisories/cve-2025-5591