Skip to content

Product

sitecore Experience Platform (XP) vulnerabilities

7 published CVES affecting sitecore Experience Platform (XP), from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
7
Critical
2
High
4
Medium
1
Low
0
Unscored
0
CISA KEV
1

Latest sitecore Experience Platform (XP) CVEs

Newest publication first

  1. CVE-2025-53692 Sitecore Experience Platform Cross-Site Scripting Vulnerability

    Published
    HighCVSS 7.1 EPSS 0.38%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cross-Site Scripting (XSS).This issue affects Sitecore Experience Manager (XM): from 9....

  2. CVE-2025-53690 Sitecore Products ViewState Deserialization Vulnerability

    Published
    CriticalCVSS 9.0 EPSS 60.7% CISA KEV added 2025-09-04 Exploited in the wild

    Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

  4. CVE-2025-53693 HTML Cache Poisoning through Unsafe Reflections

    Published
    CriticalCVSS 9.8 EPSS 20.3%

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from...

  5. CVE-2025-53694 Information Disclosure in ItemServices API

    Published
    HighCVSS 7.5 EPSS 6.9%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.

  6. CVE-2015-10142 Sitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known Path

    Published
    MediumCVSS 6.9 EPSS 0.56%

    Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker to download files under the web root of...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.