CVE-2025-2748

CVE-2025-2748 is a stored cross-site scripting (XSS) flaw in Kentico Xperience: the application does not fully validate or filter files submitted through its multiple-file upload functionality (CWE-79, CWE-434). An attacker who can reach the upload feature can plant a crafted file containing script code, and when a user opens or views that hosted file, the injected script executes in the victim's browser on the site's origin (hence the changed-scope CVSS vector; user interaction is required). Successful exploitation lets the attacker run arbitrary JavaScript in victims' sessions, enabling cookie/token theft, impersonation of authenticated users or admins, and unauthorized actions within the CMS. All Kentico Xperience deployments running version 13.0.178 or earlier are affected; the issue carries a medium CVSS 3.1 score of 6.1 and was published with VulnCheck as the CNA. It is not yet in CISA's KEV catalog and no public proof-of-concept is known, but a high EPSS score of 60.6% (99th percentile) indicates a strong likelihood of exploitation attempts within 30 days.

What to do: Upgrade Kentico Xperience 13 to a hotfix/build newer than 13.0.178 as directed in Kentico's security advisory. Until patched, restrict allowed upload file types, serve uploaded files (especially HTML/SVG) with sanitized content types from a segregated path or origin, and audit upload directories for files containing embedded scripts. Because exploitation requires a victim to open the attacker-supplied file, monitor upload activity for unexpected files and watch for user reports of script execution in the CMS.