Sitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSS

5.1 CVSS

Vulnerability Description

A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-4979

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Sitecore

View All →

CVE-2025-53694

Information Disclosure in ItemServices API

High 7.5

CVE-2025-53693

HTML Cache Poisoning through Unsafe Reflections

Critical 9.8

CVE-2025-53692

Sitecore Experience Platform Cross-Site Scripting Vulnerability

High 7.1

CVE-2025-53691

Sitecore Experience Remote Code Execution through Insecure Deserialization

High 8.8

CVE-2025-53690

Sitecore Products ViewState Deserialization Vulnerability

Critical 9

Affected Vendor

Sitecore

View all reports →

Affected Software

Experience Platform, Content Mangement System (CMS), Managed Cloud

Vulnerable Versions:

7.5 Initial Release, 8.0 Initial Release, 8.1 Initial Release, 8.2 Initial Release, 9.0 Initial Release, 9.1 Initial Release, 9.2 Initial Release, 9.3 Initial Release, 10.0 Initial Release, 10.1 Initial Release, 10.2 Initial Release, 7.2 Initial Release, *