What’s Vulnerable › Products

Kentico Xperience vulnerabilities

51 known vulnerabilities, 4 confirmed exploited in the wild (CISA KEV), 35 published in the last 12 months.

Check whether your Kentico Xperience version is affected

Exploited Kentico Xperience vulnerabilities

• CVE-2025-2749 — Kentico Xperience Path Traversal Vulnerability
• CVE-2025-2747 — Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2025-2746 — Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2019-10068 — Kentico Xperience Deserialization of Untrusted Data Vulnerability

Latest Kentico Xperience vulnerabilities

• CVE-2026-105046 — (CVSS 4.3)
• CVE-2025-5591 — Stored Cross-site Scripting (XSS) in Kentico Xperience 13 (CVSS 5.4)
• CVE-2024-58323 — Kentico Xperience <= 13.0.158 Checkbox Form Component Stored XSS (CVSS 5.4)
• CVE-2024-58322 — Kentico Xperience <= 13.0.158 Shipping Options Stored XSS (CVSS 5.4)
• CVE-2024-58321 — Kentico Xperience <= 13.0.159 Form Validation Stored XSS (CVSS 5.4)
• CVE-2024-58320 — Kentico Xperience <= 13.0.159 Authentication Information Disclosure (CVSS 5.3)
• CVE-2024-58319 — Kentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSS (CVSS 6.1)
• CVE-2024-58318 — Kentico Xperience <= 13.0.162 Rich Text Editor Stored XSS (CVSS 6.1)
• CVE-2024-58317 — Kentico Xperience <= 13.0.164 Cookie Security Configuration (CVSS 5.3)
• CVE-2023-53934 — Kentico Xperience <= 12.0.98 GetResource Handler Denial of Service (CVSS 7.5)
• CVE-2023-53738 — Kentico Xperience <= 13.0.109 Page Preview Reflected XSS (CVSS 5.4)
• CVE-2023-53737 — Kentico Xperience <= 13.0.101 Localization Application Stored XSS (CVSS 4.8)
• CVE-2023-53736 — Kentico Xperience <= 13.0.120 Administration Interface Reflected XSS (CVSS 5.4)
• CVE-2022-50686 — Kentico Xperience <= 12.0 Portal Engine Form Control Information Disclosure (CVSS 7.5)
• CVE-2022-50685 — Kentico Xperience <= 13.0.56 File Upload Stored XSS (CVSS 5.4)
• CVE-2022-50684 — Kentico Xperience <= 13.0.71 Form Emails HTML Injection (CVSS 6.1)
• CVE-2022-50683 — Kentico Xperience <= 13.0.74 Form Configuration Stored XSS (CVSS 5.4)
• CVE-2022-50682 — Kentico Xperience <= 13.0.79 Routing Engine CRLF Injection (CVSS 6.5)
• CVE-2022-50681 — Kentico Xperience <= 13.0.88 Rich Text Editor Reflected XSS (CVSS 6.1)
• CVE-2022-50680 — Kentico Xperience <= 13.0.92 Email Marketing Stored XSS (CVSS 4.8)
• CVE-2021-47712 — Kentico Xperience <= 12.0.102 URL Hashing Cryptography Vulnerability (CVSS 7.5)
• CVE-2021-47711 — Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection (CVSS 8.8)
• CVE-2020-36891 — Kentico Xperience <= 12.0.49 File Upload Stored XSS (CVSS 5.4)
• CVE-2020-36890 — Kentico Xperience <= 10 Administrator Access Control Bypass (CVSS 7.2)
• CVE-2020-36889 — Kentico Xperience <= 12.0.90 Administration Interface Stored XSS (CVSS 5.4)