Vulnerability · Published Mar 10, 2026 · Assigned by GitHub_M

CVE-2026-31833Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering

Medium 6.7

In plain English

A medium-severity cross-site scripting in Umbraco-CMS from umbraco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)0.3%top 76.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
NuGet	umbraco.cms	16.5.1	GHSA-vrqc-59mw-qqg7
NuGet	umbraco.cms	17.2.2	GHSA-vrqc-59mw-qqg7

Affected products (as reported)

Vendor	Product	Versions
umbraco	Umbraco-CMS	>= 16.2.0, < 16.5.1>= 17.0.0, < 17.2.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

References

https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-vrqc-59mw-qqg7 x_refsource_CONFIRM