CVE-2025-53693: HTML Cache Poisoning through Unsafe Reflections

Description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)19.9% · higher than 97% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

EP

Experience Platform (XP) · Sitecore

9.0 through 9.3; 10.0 through 10.4 · source: vendor

SE

Sitecore Experience Manager (XM) · Sitecore

9.0 through 9.3; 10.0 through 10.4 · source: vendor

EC

Experience Commerce · Sitecore

9.0 through 10.4 · source: NVD

EM

Experience Manager · Sitecore

9.0 through 10.4 · source: NVD

EP

Experience Platform · Sitecore

9.0 before 10.4; 10.4 · source: NVD

MC

Managed Cloud · Sitecore

All versions, or not specified · source: NVD