What’s Vulnerable › Vulnerabilities

CVE-2024-35239: Stored Cross-site Scripting on Components of Umbraco Forms

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-28 · updated 2026-06-17
• Weakness: CWE-79

Description

Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).

Affected products

• Umbraco.Forms.Issues: before 8.13.13; from 9.0.0 before 10.5.3; from 11.0.0 before 12.2.2; from 13.0.0 before 13.0.1 — fixed in 10.5.3, 12.2.2, 13.0.1, 8.13.13

How to fix

Upgrade to a fixed version: Umbraco.Forms.Issues 10.5.3, 12.2.2, 13.0.1, 8.13.13. Check the vendor advisory for mitigations.

References

• https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values
• https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024
• https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes
• https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024
• https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-p572-p2rj-q5f4
• https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values
• https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024
• https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes
• https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024
• https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-p572-p2rj-q5f4

Get alerted when CVE-2024-35239 or the next vulnerability affects your stack