CVE-2026-24836

HIGH7.6EPSS 0.02%

DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

Published: 1/28/2026Modified: 2/3/2026

Description

Extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed.

Affected packages (1)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1HIGH7.6CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

References (3)