CVE-2026-46609CWE-79

Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

Medium · published June 10, 2026

CVSS v3.1
4.6
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, which is rendered in the confirmation dialog without proper output encoding. This issue has been patched in version 17.4.0.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00231 · 13.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-10T15:59Z
EPSS history
Timeline
  • 10 JUN 15:59Z
    Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog
    cvelistv5