Stored Cross-site Scripting on Components of Umbraco Forms
Priority LOW 24CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00341 27th percentileScored 2026-11-07
Fix Fixed Umbraco.Forms.Issues (umbraco): 13.0.1, 12.2.2, 10.5.3 +1Umbraco.Forms (NuGet): 13.0.1, 12.2.2, 10.5.3 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| umbraco | Umbraco.Forms.Issues | 13.0.0 to before 13.0.1; 12.0.0 to before 12.2.2; 10.0.0 to before 10.5.3; before 8.13.13 | 13.0.1, 12.2.2, 10.5.3, 8.13.13 | Patch available | CNA |
| — | Umbraco.Forms (NuGet) | 13.0.0 to before 13.0.1 | 13.0.1 | Patch available | GHSA-p572-p2rj-q5f4 |
| — | Umbraco.Forms (NuGet) | 12.0.0 to before 12.2.2 | 12.2.2 | Patch available | GHSA-p572-p2rj-q5f4 |
| — | Umbraco.Forms (NuGet) | 10.0.0 to before 10.5.3 | 10.5.3 | Patch available | GHSA-p572-p2rj-q5f4 |
| — | Umbraco.Forms (NuGet) | 8.0.0 to before 8.13.13 | 8.13.13 | Patch available | GHSA-p572-p2rj-q5f4 |
- Umbraco.Forms.Issues Vendorumbraco Affected 13.0.0 to before 13.0.1; 12.0.0 to before 12.2.2; 10.0.0 to before 10.5.3; before 8.13.13 Fixed in 13.0.1, 12.2.2, 10.5.3, 8.13.13 Patch available CNA
- Umbraco.Forms (NuGet) Vendor— Affected 13.0.0 to before 13.0.1 Fixed in 13.0.1 Patch available GHSA-p572-p2rj-q5f4
- Umbraco.Forms (NuGet) Vendor— Affected 12.0.0 to before 12.2.2 Fixed in 12.2.2 Patch available GHSA-p572-p2rj-q5f4
- Umbraco.Forms (NuGet) Vendor— Affected 10.0.0 to before 10.5.3 Fixed in 10.5.3 Patch available GHSA-p572-p2rj-q5f4
- Umbraco.Forms (NuGet) Vendor— Affected 8.0.0 to before 8.13.13 Fixed in 8.13.13 Patch available GHSA-p572-p2rj-q5f4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:umbraco:umbraco_forms:*:*:*:*:*:*:*:* | before 8.13.13; 9.0.0 to before 10.5.3; 11.0.0 to before 12.2.2; 13.0.0 to before 13.0.1 | Vulnerable | umbraco |
- cpe:2.3:a:umbraco:umbraco_forms:*:*:*:*:*:*:*:* Versions before 8.13.13; 9.0.0 to before 10.5.3; 11.0.0 to before 12.2.2; 13.0.0 to before 13.0.1 Vulnerable ·umbraco
Remediation
- Fix · CNA Umbraco.Forms.Issues (umbraco) Fixed in 13.0.1, 12.2.2, 10.5.3, 8.13.13
- Fix · GHSA-p572-p2rj-q5f4 Umbraco.Forms (NuGet) Fixed in 13.0.1 Advisory →
- Fix · GHSA-p572-p2rj-q5f4 Umbraco.Forms (NuGet) Fixed in 12.2.2 Advisory →
- Fix · GHSA-p572-p2rj-q5f4 Umbraco.Forms (NuGet) Fixed in 10.5.3 Advisory →
- Fix · GHSA-p572-p2rj-q5f4 Umbraco.Forms (NuGet) Fixed in 8.13.13 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-35239
- 2026-10-03 Alias added: GHSA-p572-p2rj-q5f4
References
Advisory 2
Other 6
- https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values
- https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024
- https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes
- https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024
- https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes#version-8
- https://github.com/umbraco/Umbraco.Forms.Issues
More Umbraco Forms vulnerabilities
- TI-2021-12768 File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to… CVSS 3.1CRITICAL 9.8
- TI-2025-42380 Deserialization of untrusted data in umbraco Forms CVSS 3.1HIGH 7.5
- TI-2020-06205 Insecure Defaults CVSS 3.1HIGH 7.5
- TI-2025-16851 Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms CVSS 3.1MEDIUM 5.8
- TI-2026-19909 Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac CVSS 4.0MEDIUM 6.0
- TI-2025-29810 Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow CVSS 4.0LOW 2.3
Sources
- CVE-2024-35239 · CVE Program
- CVE-2024-35239 · NVD
- FIRST EPSS
- GHSA-p572-p2rj-q5f4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences