| Package | Affected versions | Patched versions |
|---|---|---|
| UmbracoCms.Core | ≤ 8.9.1 | |
| umbraco cms | ≤ 8.9.1 |
A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free