DotNetNuke.Core Vulnerable to Stored XSS via Module Title

MEDIUM 5.4CVE-2026-24838 · GHSA-w9pf-h6m6-v89h · Published 28/01/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
DotNetNuke.Core NuGet	`≥ 10.0.0, < 10.2.0< 9.13.10`	`10.2.09.13.10`
dotnetnuke dnnsoftware	`≥ 10.0.0, < 10.2.0< 9.13.10`	`10.2.09.13.10`

Description

Module title supports richtext which could include scripts that would execute in certain scenarios.

NVD description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

References

dnnsoftware/Dnn.Platform security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-24838 · ADVISORY
dnnsoftware/Dnn.Platform commit 4a4bcbc · WEB
dnnsoftware/Dnn.Platform · PACKAGE
dnnsoftware/Dnn.Platform release v10.2.0 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free