CVE-2025-27802CWE-79

Stored Cross-Site Scripting in Episerver Content Management System (CMS) Edit Preview

Medium · published July 28, 2025

CVSS v4.0
4.8
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser.

RTE properties (text fields), which could be used in the "Edit" section of the CMS,

allowed the input of arbitrary text. It was possible to input malicious JavaScript

code in these properties that would be executed if a user visits the previewed

page. Attackers needed at least the role "WebEditor" in order to exploit this issue.

Affected products: Version 11.X: EPiServer.CMS.Core (<11.21.4) with EPiServer.CMS.UI (<11.37.5), Version 12.X: EPiServer.CMS.Core (<12.22.1) with EPiServer.CMS.UI (<11.37.3)

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:L/SC:L/SI:L/SA:N
EPSS
0.00339 · 26.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-07-28T08:47Z
EPSS history
Timeline
  • 28 JUL 08:47Z
    Stored Cross-Site Scripting in Episerver Content Management System (CMS) Edit Preview
    cvelistv5