DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer

MEDIUM 4.8CVE-2026-24784 · GHSA-jjwg-4948-6wxp · Published 28/01/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
DotNetNuke.Core NuGet	`≥ 10.0.0, < 10.2.0≥ 9.0.0, < 9.13.10`	`10.2.09.13.10`
dotnetnuke dnnsoftware	`≥ 10.0.0, < 10.2.0≥ 9.0.0, < 9.13.10`	`10.2.09.13.10`

Description

A content editor could inject scripts in module headers/footers that would run for other users.

NVD description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a content editor could inject scripts in module headers/footers that would run for other users. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

References

dnnsoftware/Dnn.Platform security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-24784 · ADVISORY
dnnsoftware/Dnn.Platform · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free