xperience vulnerabilities and fixes

Recent CVEs affecting xperience, with upgrade or downgrade steps. 34 tracked.

xperience has 34 tracked vulnerabilities, 2 critical and 3 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 34. Most recent: 2026-01-05. Highest priority: CVE-2025-2747 (score 97/100).

• CVE-2025-5591 MEDIUM 5.4 UPGRADE Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an a
• CVE-2020-36890 HIGH 7.2 UPGRADE An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrat
• CVE-2025-32370 HIGH 7.2 UPGRADE Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenti
• CVE-2025-32369 MEDIUM 6.4 UPGRADE Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS)
• CVE-2025-2794 HIGH 8.7 UPGRADE An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current
• CVE-2025-2749 HIGH 7.2 EXPLOITED UPGRADE Kentico Xperience Path Traversal Vulnerability
• CVE-2025-2748 MEDIUM 6.1 UPGRADE The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file uploa
• CVE-2025-2747 CRITICAL 9.8 EXPLOITED UPGRADE Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2025-2746 CRITICAL 9.8 EXPLOITED UPGRADE Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2024-58323 MEDIUM 5.4 UPGRADE A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts
• CVE-2024-58322 MEDIUM 5.4 UPGRADE A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code int
• CVE-2024-58321 MEDIUM 5.4 UPGRADE A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts
• CVE-2024-58320 MEDIUM 5.3 UPGRADE An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administr
• CVE-2024-58319 MEDIUM 6.1 UPGRADE A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scrip
• CVE-2024-58318 MEDIUM 6.1 UPGRADE A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts
• CVE-2024-58317 MEDIUM 5.3 UPGRADE A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements
• CVE-2023-53934 HIGH 7.5 UPGRADE A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially cr
• CVE-2023-53738 MEDIUM 5.4 UPGRADE A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malic
• CVE-2023-53737 MEDIUM 4.8 UPGRADE A stored cross-site scripting vulnerability in Kentico Xperience allows global administrators to inject malici
• CVE-2023-53736 MEDIUM 5.4 UPGRADE A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malic
• CVE-2022-50686 HIGH 7.5 UPGRADE An information disclosure vulnerability in Kentico Xperience allows attackers to view sensitive stack trace de
• CVE-2022-50685 MEDIUM 5.4 UPGRADE A stored cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject maliciou
• CVE-2022-50684 MEDIUM 6.1 UPGRADE An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into for
• CVE-2022-50683 MEDIUM 5.4 UPGRADE A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts
• CVE-2022-50682 MEDIUM 6.5 UPGRADE A CRLF injection vulnerability in Kentico Xperience allows attackers to manipulate URL query string redirects
• CVE-2022-50681 MEDIUM 6.1 UPGRADE A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scrip
• CVE-2022-50680 MEDIUM 4.8 UPGRADE A stored cross-site scripting vulnerability in Kentico Xperience allows administration users to inject malicio
• CVE-2021-47712 HIGH 7.5 UPGRADE A cryptography vulnerability in Kentico Xperience allows attackers to potentially manipulate URL hash values t
• CVE-2021-47711 HIGH 8.8 UPGRADE A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL querie
• CVE-2020-36891 MEDIUM 5.4 UPGRADE A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed
• CVE-2020-36889 MEDIUM 5.4 UPGRADE A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts
• CVE-2019-25230 MEDIUM 4.3 UPGRADE An information disclosure vulnerability in Kentico Xperience allows authenticated users to view sensitive syst
• CVE-2019-25229 HIGH 8.8 UPGRADE An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' per
• CVE-2019-25228 MEDIUM 5.3 UPGRADE An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via

FAQ

How do I fix xperience vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is xperience being exploited right now?

Yes: 3 xperience CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which xperience CVE should I patch first?

CVE-2025-2747 currently ranks highest (97/100): Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability.

RSS feed for xperience · ← Back to latest CVEs