CVE-2024-58321 - Kentico Xperience <= 13.0.159 Form Validation Stored XSS

Back Back to CVE browser

MEDIUM

Kentico Xperience <= 13.0.159 Form Validation Stored XSS

Published Dec 18, 2025

5.1

MEDIUM

CVSS 4.0

EPSS 0.17%

Description

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule configuration. Attackers can exploit this vulnerability to execute malicious scripts that will run in users' browsers.

Affected products

Vendor Kentico Product Xperience Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=13.0.159

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Kentico

Xperience

n/a

Version	Status	Constraints
0	affected	<=13.0.159

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://devnet.kentico.com/download/hotfixes
vendor-advisorypatchProduct
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-204331
Advisory
https://www.vulncheck.com/advisories/kentico-xperience-form-validation-stored-xss
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://devnet.kentico.com/download/hotfixes		vendor-advisorypatchProduct
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-204331		Advisory
https://www.vulncheck.com/advisories/kentico-xperience-form-validation-stored-xss		third-party-advisoryThird Party Advisory