PT-2026-1201 · Kentico · Kentico Xperience 13

Michael Nervo · Published 2026-01-05 · Updated 2026-01-22 · CVE-2025-5591

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U

Name of the Vulnerable Software and Affected Versions Kentico Xperience version 13

Description Kentico Xperience 13 is susceptible to a stored cross-site scripting (XSS) attack through a form component. This allows an attacker to hijack a victim user’s session and perform actions with the victim’s permissions. The vulnerability specifically resides in the Checkbox form component of Form Builder. Successful exploitation involves injecting malicious scripts that execute in the victim’s browser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-1188

CWE-79

Related Identifiers

CVE-2025-5591

Affected Products

Kentico Xperience 13

References · 9

• https://osv.dev/vulnerability/CVE-2025-5591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5591 · Security Note
• https://themissinglink.com.au/security-advisories/cve-2025-5591 · Note
• https://twitter.com/transilienceai/status/2008018329139663309 · Twitter Post
• https://t.me/cveNotify/147662 · Telegram Post
• https://twitter.com/CVEnew/status/2008017769791393942 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2009831458735829049 · Twitter Post
• https://t.me/cveNotify/149584 · Telegram Post
• https://t.me/CVEtracker/41338 · Telegram Post