Vulnerability · Published Dec 18, 2025 · Assigned by VulnCheck
CVE-2022-50684Kentico Xperience <= 13.0.71 Form Emails HTML Injection
Medium 6.1
In plain English
A medium-severity cross-site scripting in Xperience from Kentico. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.2%top 90.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into form submission emails via unencoded form fields. Unencoded form values could enable HTML content execution in recipient email clients, potentially compromising email security.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- Kentico DevNet Hotfixes vendor-advisory, patch
- VulnCheck Advisory: Kentico Xperience <= 13.0.71 Form Emails HTML Injection third-party-advisory