CVE-2025-5591: Stored Cross-site Scripting (XSS) in Kentico Xperience 13

Description

Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.

Scores

CVSS scores of CVE-2025-5591, by who scored it
Scored by	CVSS	Score	Vector
TMLCNA (assigner)	4.0	High7.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U
NVDNVD · Analyzed	4.0	High7.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.17% · top 93% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.7.

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs
CWE-1188 Insecure Default Initialization of Resource (opens in a new tab)All about CWE-1188 and its CVEs

Affected products

Kentico · Kentico Xperience
- affected 13.0.167

What to do

Solution: Change Kentico's default configuration as per the vendor's advisory: https://docs.kentico.com/13/macro-expressions/reference-macro-methods#advanced-text-processing

References (1)

https://www.themissinglink.com.au/security-advisories/cve-2025-5591 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-5591](https://trackcve.app/badge/CVE-2025-5591.svg)](https://trackcve.app/cve/CVE-2025-5591)

Record last updated 5 Jan 2026, 20:34 UTC.