Vulnerability · Published Sep 3, 2025 · Assigned by Wiz
CVE-2025-53694Information Disclosure in ItemServices API
High 7.5
In plain English
A high-severity information exposure in Experience Platform (XP) from Sitecore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 6.9% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)6.9%top 5.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sitecore | Sitecore Experience Manager (XM) | 9.2 – through 10.4 |
| Sitecore | Experience Platform (XP) | 9.2 – through 10.4 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N