Xperience vulnerabilities
CVEs whose affected-version data names the Xperience package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-105046Medium· 4.3Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.
Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.
▾ SunlitKentico · Xperiencevia NVD
CVE-2025-5591Medium· 5.4Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.
Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.
▾ Sunlitkentico · xperienceEPSS 0.17%via NVD
CVE-2020-36890High· 7.2An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests
An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalida…
▾ Twilightkentico · xperienceEPSS 0.34%via NVD