DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

MEDIUM 5.4CVE-2026-24837 · GHSA-vm5q-8qww-h238 · Published 28/01/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
DotNetNuke.Core NuGet	`≥ 10.0.0, < 10.2.0≥ 9.0.0, ≤ 9.13.9`	`10.2.0`
dotnetnuke dnnsoftware	`≥ 10.0.0, < 10.2.0≥ 9.0.0, < 9.13.10`	`10.2.09.13.10`

Description

A module friendly name could include scripts that will run during some module operations in the Persona Bar.

NVD description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a module friendly name could include scripts that will run during some module operations in the Persona Bar. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

References

dnnsoftware/Dnn.Platform security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-24837 · ADVISORY
dnnsoftware/Dnn.Platform · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free