XP
Product
Xperience
On CISA KEVExploited in the wild
51
CVEs
4
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 6High 14Medium 31Low 0
Watch
Add Xperience to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-50682 | 6.5 | Dec 18 | Kentico Xperience <= 13.0.79 Routing Engine CRLF Injection Affected: through 13.0.79 |
| CVE-2024-58319 | 6.1 | Dec 18 | Kentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSS Affected: through 13.0.160 |
| CVE-2024-58318 | 6.1 | Dec 18 | Kentico Xperience <= 13.0.162 Rich Text Editor Stored XSS Affected: through 13.0.162 |
| CVE-2022-50684 | 6.1 | Dec 18 | Kentico Xperience <= 13.0.71 Form Emails HTML Injection Affected: through 13.0.71 |
| CVE-2022-50681 | 6.1 | Dec 18 | Kentico Xperience <= 13.0.88 Rich Text Editor Reflected XSS Affected: through 13.0.88 |
| CVE-2025-2748 | 6.1 | Mar 24 | The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects… Affected: through 13.0.178 |
| CVE-2021-46163 | 6.1 | Jan 10 | Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem Affected: 13.0.44 |
| CVE-2020-24794 | 6.1 | Sep 9 | Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75 Affected: before 12.0.75 |
| CVE-2025-5591 | 5.4 | Jan 5 | Stored Cross-site Scripting (XSS) in Kentico Xperience 13 Affected: 13.0.0 before 13.0.167 |
| CVE-2024-58323 | 5.4 | Dec 18 | Kentico Xperience <= 13.0.158 Checkbox Form Component Stored XSS Affected: through 13.0.158 |
| CVE-2024-58322 | 5.4 | Dec 18 | Kentico Xperience <= 13.0.158 Shipping Options Stored XSS Affected: through 13.0.158 |
| CVE-2024-58321 | 5.4 | Dec 18 | Kentico Xperience <= 13.0.159 Form Validation Stored XSS Affected: through 13.0.159 |
| CVE-2023-53738 | 5.4 | Dec 18 | Kentico Xperience <= 13.0.109 Page Preview Reflected XSS Affected: through 13.0.109 |
| CVE-2023-53736 | 5.4 | Dec 18 | Kentico Xperience <= 13.0.120 Administration Interface Reflected XSS Affected: through 13.0.120 |
| CVE-2022-50685 | 5.4 | Dec 18 | Kentico Xperience <= 13.0.56 File Upload Stored XSS Affected: through 13.0.56 |
| CVE-2022-50683 | 5.4 | Dec 18 | Kentico Xperience <= 13.0.74 Form Configuration Stored XSS Affected: through 13.0.74 |
| CVE-2020-36891 | 5.4 | Dec 18 | Kentico Xperience <= 12.0.49 File Upload Stored XSS Affected: through 12.0.49 |
| CVE-2020-36889 | 5.4 | Dec 18 | Kentico Xperience <= 12.0.90 Administration Interface Stored XSS Affected: through 12.0.90 |
| CVE-2025-32369 | 5.4 | Apr 6 | Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with the media library file upload feature Affected: before 13.0.181 |
| CVE-2021-43991 | 5.4 | Dec 3 | The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS) Affected: 13.0.0 through 13.0.43 |
| CVE-2019-19493 | 5.4 | Dec 2 | Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS Affected: 9.0 before 12.0.50 |
| CVE-2018-6842 | 5.4 | Mar 19 | Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page Affected: 10.0 before 10.0.50; 11.0 before 11.0.3 |
| CVE-2024-58320 | 5.3 | Dec 18 | Kentico Xperience <= 13.0.159 Authentication Information Disclosure Affected: through 13.0.159 |
| CVE-2024-58317 | 5.3 | Dec 18 | Kentico Xperience <= 13.0.164 Cookie Security Configuration Affected: through 13.0.164 |
| CVE-2019-25228 | 5.3 | Dec 18 | Kentico Xperience <= 12.0.47 Virtual Context Information Disclosure Affected: through 12.0.47 |
| CVE-2022-29287 | 4.9 | Apr 16 | Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability Affected: before 13.0.66 |
| CVE-2023-53737 | 4.8 | Dec 18 | Kentico Xperience <= 13.0.101 Localization Application Stored XSS Affected: through 13.0.101 |
| CVE-2022-50680 | 4.8 | Dec 18 | Kentico Xperience <= 13.0.92 Email Marketing Stored XSS Affected: through 13.0.92 |
| CVE-2018-7205 | 4.8 | Feb 20 | Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious… Affected: 9.0 through 11.0 |
| CVE-2026-105046 | 4.3 | Oct 2 | Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints Affected: 13.0.0 before 13.0.216 |
| CVE-2019-25230 | 4.3 | Dec 18 | Kentico Xperience <= 12.0.0 User Widget Information Disclosure Affected: through 12.0.0 |
Showing 31