Log in Start free

Vulnerability · Published Jul 25, 2025 · Assigned by VulnCheck

CVE-2022-4979Sitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSS

Medium 5.1

In plain English

A medium-severity cross-site scripting in Content Mangement System (CMS) from Sitecore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.7%top 45.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.

Affected products (as reported)

VendorProductVersions
Sitecore Experience Platform 7.5 Initial Release – through 7.5 Update-28.0 Initial Release – through 8.0 Update-78.1 Initial Release – through 8.1 Update-38.2 Initial Release – through 8.2 Update-79.0 Initial Release – through 9.0 Update-29.1 Initial Release – through 9.1 Update 19.2 Initial Release9.3 Initial Release
Sitecore Content Mangement System (CMS) 7.2 Initial Release – through 7.2 Update-6
Sitecore Managed Cloud *

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References