Sitecore vulnerabilities
12 published CVEs name Sitecore among the affected products; CISA lists 1 of them as exploited in the wild.
- Published CVEs
- 12
- Last 12 months
- 0
- Critical
- 2
- Known exploited
- 1
Critical 2High 8Medium 2Low 0Not scored 0
Known exploitedNewest addition to KEV first
- CVE-2025-53690
Sitecore Products ViewState Deserialization Vulnerability
Sitecore · Experience Manager (XM)
ExploitedCritical9.0
Newest CVEs
- CVE-2025-53692
Sitecore Experience Platform Cross-Site Scripting Vulnerability
Sitecore · Sitecore Experience Manager (XM)
High7.1 - CVE-2025-53690
Sitecore Products ViewState Deserialization Vulnerability
Sitecore · Experience Manager (XM)
ExploitedCritical9.0 - CVE-2025-53691
Sitecore Experience Remote Code Execution through Insecure Deserialization
Sitecore · Experience Manager (XM)
High8.8 - CVE-2025-53693
HTML Cache Poisoning through Unsafe Reflections
Sitecore · Sitecore Experience Manager (XM)
Critical9.8 - CVE-2025-53694
Information Disclosure in ItemServices API
Sitecore · Sitecore Experience Manager (XM)
High7.5 - CVE-2022-4979
Sitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSS
Sitecore · Experience Platform
Medium5.1 - CVE-2015-10142
Sitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known Path
Sitecore · Experience Platform (XP)
Medium6.9 - CVE-2025-34139
Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read
Sitecore · Experience Manager (XM)
High8.7 - CVE-2020-36850
Sitecore JSS React Sample Application 11.0.0 - 14.0.1 Information Disclosure
Sitecore · JSS React Sample Application
High8.7 - CVE-2025-34511
Sitecore PowerShell Extension RCE via Unrestricted Upload
Sitecore · Powershell Extension
High8.8