Stored Cross-site Scripting on Print Functionality in Umbraco Commerce
Priority LOW 24CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Umbraco Commerce is an open source dotnet ecommerce solution. In affected versions there exists a stored Cross-site scripting (XSS) issue which would enable attackers to inject malicious code into Print Functionality. This issue has been addressed in versions 12.1.4, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00286 21st percentileScored 2026-11-07
Fix Fixed Umbraco.Commerce.Issues (umbraco): 12.1.4, 10.0.5Umbraco.Commerce (NuGet): 12.1.4, 10.0.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| umbraco | Umbraco.Commerce.Issues | 12.0.0 to before 12.1.4; before 10.0.5 | 12.1.4, 10.0.5 | Patch available | CNA |
| — | Umbraco.Commerce (NuGet) | 12.0.0 to before 12.1.4 | 12.1.4 | Patch available | GHSA-rpj9-xjwm-wr6w |
| — | Umbraco.Commerce (NuGet) | before 10.0.5 | 10.0.5 | Patch available | GHSA-rpj9-xjwm-wr6w |
- Umbraco.Commerce.Issues Vendorumbraco Affected 12.0.0 to before 12.1.4; before 10.0.5 Fixed in 12.1.4, 10.0.5 Patch available CNA
- Umbraco.Commerce (NuGet) Vendor— Affected 12.0.0 to before 12.1.4 Fixed in 12.1.4 Patch available GHSA-rpj9-xjwm-wr6w
- Umbraco.Commerce (NuGet) Vendor— Affected before 10.0.5 Fixed in 10.0.5 Patch available GHSA-rpj9-xjwm-wr6w
Remediation
- Fix · CNA Umbraco.Commerce.Issues (umbraco) Fixed in 12.1.4, 10.0.5
- Fix · GHSA-rpj9-xjwm-wr6w Umbraco.Commerce (NuGet) Fixed in 12.1.4 Advisory →
- Fix · GHSA-rpj9-xjwm-wr6w Umbraco.Commerce (NuGet) Fixed in 10.0.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-35240
- 2026-10-03 Alias added: GHSA-rpj9-xjwm-wr6w
References
More umbraco vulnerabilities
- TI-2025-41183 An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute… CVSS 3.1CRITICAL 10.0
- TI-2012-05477 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE CVSS 4.0CRITICAL 9.3
- TI-2021-22392 Umbraco v8.14.1 - 'baseUrl' SSRF CVSS 4.0MEDIUM 6.9
- TI-2024-36846 A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers… CVSS 3.1MEDIUM 6.5
- TI-2019-15240 Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by… CVSS 3.1HIGH 7.2
- TI-2020-04738 Cross-site scripting in Umbraco CMS CVSS 3.1MEDIUM 5.4
Sources
- CVE-2024-35240 · CVE Program
- CVE-2024-35240 · NVD
- FIRST EPSS
- GHSA-rpj9-xjwm-wr6w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences